Back to Knowledge Vault

Two NHS Trusts Targeted via Ivanti Vulnerability

Two major NHS trusts— University College London Hospitals NHS Foundation Trust and University Hospital Southampton NHS Foundation Trust —have been exposed in a…

Two major NHS trusts—University College London Hospitals NHS Foundation Trust and University Hospital Southampton NHS Foundation Trust—have been exposed in a newly identified cyberattack, after threat actors exploited a vulnerability in a widely used device management platform.

The breach, linked to Ivanti Endpoint Manager Mobile (EPMM), enabled attackers to gain unauthorised access to internal systems. Security analysts confirm that this was not a ransomware event, but a stealth intrusion designed to extract sensitive information without triggering standard alarms.

The software in question is commonly deployed across enterprise and public sector environments to manage and secure employee mobile devices. In this instance, attackers exploited a known flaw to infiltrate network environments and access data silently.

Cybersecurity experts warn that the incident could result in the exposure of highly sensitive patient records and operational data.

“This represents a clear example of the growing threat posed by software-based vulnerabilities, especially in systems that underpin large, distributed networks such as those used in healthcare,” one analyst stated. “The data wasn’t locked—it was taken, quietly.”

The breach forms part of a broader campaign affecting organisations in the UK, Europe, the US, and Asia, with victims spanning healthcare, government, and commercial sectors.

A Wake-Up Call for Healthcare Security

The attack highlights a shift in tactics from disruptive ransomware to clandestine data harvesting, where the goal is no longer to shut down systems but to extract valuable information unnoticed.

With investigations ongoing, NHS security teams and national cybersecurity authorities are assessing the scope of the breach and issuing guidance to mitigate further exposure.

There is currently no confirmation of the volume or type of data accessed, and both trusts have yet to issue formal public statements.

Exploring Offline Alternatives

As cyber threats grow increasingly sophisticated, some organisations are beginning to reconsider the default assumption that all data must remain connected. Solutions such as Firevault a fully offline digital vault are gaining attention for offering a fundamentally different approach: disconnecting critical files from the internet entirely.

By physically isolating sensitive digital assets, Firevault aims to render data invisible and inaccessible to remote attackers, regardless of how advanced their intrusion methods may be. In a climate where exploits can sit undetected for months, offline storage is becoming part of a wider conversation around resilience and patient data protection.

This latest breach reinforces the urgency for healthcare providers to not only patch software and strengthen monitoring, but also rethink their exposure surface and ask what truly needs to stay online.

Share this article