Full Report
A data breach involving Barts Health NHS Trust was reported in December 2025. See incident details, impact on customers, and recommended security measures.
Analysis Summary
# Incident Report: Barts Health NHS Trust Data Breach (Clop Attack)
## Executive Summary
Barts Health NHS Trust suffered a significant data breach in 2025, attributed to the Clop ransomware group. Attackers exploited a zero-day vulnerability in the Oracle E-Business Suite, leading to the exfiltration of invoices containing names and physical addresses of paying individuals. Although the compromise occurred in the summer, the breach was only confirmed in December 2025 following data publication on the dark web.
## Incident Details
- Discovery Date: November 2025 (Confirmed via dark web leak)
- Incident Date: Initial compromise occurred starting July 31, 2025, and continued through August 2025.
- Affected Organization: Barts Health NHS Trust (bartshealth.nhs.uk)
- Sector: Healthcare (NHS)
- Geography: United Kingdom (Implied by Trust name)
## Timeline of Events
### Initial Access
- Date/Time: On or around July 31, 2025
- Vector: Exploitation of a zero-day vulnerability.
- Details: Attackers gained initial access by leveraging an undisclosed zero-day flaw present in the organization's Oracle E-Business Suite software.
### Lateral Movement
- (Information not explicitly detailed in the source, but implied as necessary to reach data stores.)
### Data Exfiltration/Impact
- Data Stolen: Invoices containing full names and physical addresses of individuals who paid for services at the hospital. The breach was categorized as "data theft."
### Detection & Response
- Detection: November 2025, when the stolen data appeared on a dark web leak site.
- Response Actions: The Trust disclosed the breach on December 5, 2025, and is actively seeking a High Court order to prevent the further publication or sharing of the stolen invoice data.
## Attack Methodology
- Initial Access: Exploitation of a zero-day vulnerability in Oracle E-Business Suite software.
- Persistence: (Not explicitly detailed)
- Privilege Escalation: (Not explicitly detailed)
- Defense Evasion: (Not explicitly detailed, but likely inherent in zero-day exploitation)
- Credential Access: (Not explicitly detailed)
- Discovery: (Not explicitly detailed)
- Lateral Movement: (Not explicitly detailed)
- Collection: Gathering of invoices containing personal identifiable information (PII).
- Exfiltration: Theft of sensitive data, leveraging a typical Clop tactic (double extortion).
- Impact: Data theft (no immediate mention of system encryption/ransom demand, but characteristic of Clop).
## Impact Assessment
- Financial: (Not specified)
- Data Breach: Invoices containing full names and physical addresses of service-paying individuals.
- Operational: The disclosure characterizes it as a "significant security incident," suggesting operational impact, though specific downtime is not detailed.
- Reputational: Public disclosure of a major data breach involving patient data affiliates is highly damaging.
## Indicators of Compromise
- Network indicators: (None provided)
- File indicators: (None provided)
- Behavioral indicators: Evidence of data exposure on a dark web leak site in November 2025.
## Response Actions
- Containment: (Not explicitly detailed)
- Eradication steps: (Not explicitly detailed)
- Recovery actions: Seeking a High Court order to block further sharing of stolen data.
## Lessons Learned
- Reliance on unpatched or vulnerable third-party enterprise software (Oracle E-Business Suite) presents a critical risk, especially when zero-day vulnerabilities are exploited.
- Detection latency was significant: The compromise occurred in July/August, but detection was not confirmed until November.
- The threat actor (Clop) specializes in exploiting zero-day vulnerabilities in managed file transfer/enterprise software.
## Recommendations
- Immediately prioritize patching and vulnerability management for all enterprise applications, particularly those exposed or critical to operations (like Oracle E-Business Suite).
- Enhance proactive monitoring and threat hunting, especially focusing on signs of data staging or outbound traffic anomalies, to reduce the detection gap between compromise (July) and confirmation (November).
- Review third-party risk management associated with enterprise software vendors to ensure rapid dissemination and application of security advisories concerning zero-day threats.