Full Report
A data breach involving Barts Health NHS Trust was reported in December 2025. See incident details, impact on customers, and recommended security measures.
Analysis Summary
# Incident Report: Barts Health NHS Trust Data Theft via Oracle Zero-Day Exploit
## Executive Summary
Barts Health NHS Trust disclosed a significant data breach on December 5, 2025, attributed to the sophisticated threat actor Clop. The attackers exploited an undisclosed zero-day vulnerability in the Trust's Oracle E-Business Suite software, leading to the exfiltration of sensitive customer invoice data, including names and physical addresses. The breach activity occurred over several months before being confirmed by data appearing on the dark web.
## Incident Details
- Discovery Date: November 2025 (when data appeared on a dark web leak site)
- Incident Date: Initial compromise on July 31, 2025, continuing through August 2025.
- Affected Organization: Barts Health NHS Trust (bartshealth.nhs.uk)
- Sector: Healthcare (NHS)
- Geography: UK
## Timeline of Events
### Initial Access
- **Date/Time:** July 31, 2025
- **Vector:** Exploitation of a zero-day vulnerability in Oracle E-Business Suite software.
- **Details:** Attackers gained initial unauthorized access using the unpatched flaw in the enterprise software.
### Lateral Movement
- *Details not explicitly provided in the source, but assumed standard for data exfiltration.*
### Data Exfiltration/Impact
- **Date/Time:** Continued through August 2025
- **Details:** Theft of invoices containing full names and physical addresses of individuals who had paid for hospital services. The Trust characterized this as "data theft."
### Detection & Response
- **Date/Time:** November 2025 (Confirmation) / December 5, 2025 (Public Disclosure)
- **Detection Method:** Stolen data was observed on a dark web leak site belonging to the Clop group.
- **Response Actions:** The Trust initiated actions, including seeking a High Court order to prevent the further publication or sharing of the stolen data.
## Attack Methodology
- **Initial Access:** Exploitation of a zero-day vulnerability in Oracle E-Business Suite.
- **Persistence:** *Not explicitly detailed.*
- **Privilege Escalation:** *Not explicitly detailed.*
- **Defense Evasion:** *Implied evasion through the use of a zero-day exploit.*
- **Credential Access:** *Not explicitly detailed.*
- **Discovery:** *Not explicitly detailed.*
- **Lateral Movement:** *Not explicitly detailed.*
- **Collection:** Gathering of invoices containing customer names and physical addresses.
- **Exfiltration:** Theft of collected invoice data.
- **Impact:** Data theft (Double Extortion tactic, although encryption was not the primary reported impact).
## Impact Assessment
- **Financial:** *Not specified, but costs associated with litigation (High Court Order) and remediation expected.*
- **Data Breach:** Theft of PII, including **full names and physical addresses** of paying individuals.
- **Operational:** *Not specified, beyond the security incident itself.*
- **Reputational:** High severity incident involving a breach of sensitive customer data affecting a major public health entity in the UK.
## Indicators of Compromise
- **Network Indicators (Defanged):** *None provided.*
- **File Indicators:** *None provided.*
- **Behavioral Indicators:** Observance of exfiltrated customer invoice data on known dark web leak sites associated with Clop.
## Response Actions
- **Containment Measures:** *Containment details pending further investigation, likely involving patching/isolating the affected Oracle E-Business Suite instance.*
- **Eradication Steps:** *Not detailed.*
- **Recovery Actions:** Focus on legal action: Seeking a High Court order to stop the publication/sharing of the stolen data.
## Lessons Learned
- Reliance on third-party, enterprise software (Oracle E-Business Suite) presents significant supply chain/vendor risk, particularly when zero-day vulnerabilities exist.
- Timely detection remains a major challenge, as the initial compromise months prior to confirmation allowed for extensive data theft.
- The threat actor, Clop, continues to prioritize vulnerable file transfer/management systems for initial compromise.
## Recommendations
- Immediately apply any available security patches or workarounds for Oracle E-Business Suite, prioritizing vulnerability disclosure programs (VDPs) if patches are not yet released.
- Implement enhanced monitoring and auditing on critical enterprise resource planning (ERP) systems like Oracle EBS to detect anomalous data access or exfiltration patterns immediately.
- Review data minimization policies to ensure that unnecessary personally identifiable information (PII) is not stored alongside transactional data (invoices).