ISO 27001 and the NHS Breach: A Wake-Up Call for Data Security

In a stark reminder of the growing cyber threat landscape, NHS Dumfries & Galloway confirmed in April 2025 that it had suffered a serious cyberattack which compromised both patient and staff data. The INC Ransom gang, a known ransomware group, claimed responsibility - later publishing highly sensitive documents on the dark web to prove they had successfully exfiltrated internal data.

The incident is one of the most severe breaches in recent years within the UK healthcare sector and highlights an ongoing vulnerability in public infrastructure when it comes to managing information security. But could it have been prevented - or at least better mitigated - through more structured security controls?

The answer lies in ISO 27001:2022, the internationally recognised standard for information security management.

What Happened in the NHS Dumfries & Galloway Attack?

According to the health board, suspicious activity was first detected in late March 2025. Immediate containment efforts followed, with systems disconnected to prevent spread. However, by early April, it became clear that a breach had occurred. Files leaked online included:

• Patient records, including names, addresses, dates of birth, and treatment histories.

• Internal reports and staff data, including HR files and training records.

• Screenshots of live systems, including appointment databases and access logs.

The INC Ransom group, which has also targeted councils and hospitals in the US and Europe, claimed responsibility. Their dark web leak site displayed dozens of files, alongside a demand for payment and a threat to leak more data unless their demands were met. The NHS did not negotiate, and further data was released in stages.

This led to enormous disruption and distress for patients and staff alike. The Information Commissioner’s Office (ICO), National Cyber Security Centre (NCSC), and Police Scotland launched investigations into how the breach occurred and how much data was compromised.

The Role ISO 27001 Could Have Played

The ISO 27001 standard is built to prevent exactly this kind of incident - or at the very least, minimise the risk and impact.

Here’s how its structured approach could have helped:

Information Security Risk Assessment (Clause 6.1.2 & Annex A.5.4)

ISO 27001 requires organisations to assess all risks to information security - including threats like ransomware and unauthorised access. A well-maintained risk register could have highlighted vulnerabilities in legacy systems, underprotected endpoints, or third-party tools.

Supplier and Third-Party Controls (Annex A.5.19 & A.5.20)

The health sector often works with dozens of suppliers and IT partners. ISO 27001 demands due diligence and contractual controls to ensure all third-party systems meet security standards. In many cyberattacks, attackers gain access through weak vendor security - something proper supplier vetting could avoid.

Security Awareness and Training (Annex A.6.3)

Phishing emails remain a common ransomware delivery method. ISO 27001 mandates regular, documented security training for staff to recognise threats - from suspicious attachments to social engineering.

Incident Response Planning (Annex A.5.29 & A.5.30)

The NHS responded relatively quickly once the breach was identified. However, an ISO-certified ISMS includes a predefined, tested incident response plan - making responses faster, more co-ordinated, and less damaging.

Backup and Recovery (Annex A.8.13)

Organisations certified to ISO 27001 must ensure backups are secure, tested, and ready for use. This reduces reliance on negotiating with ransomware attackers and ensures operations can be restored swiftly without paying a ransom.

Access Controls (Annex A.5.15 – A.5.18)

Limiting who can access what - and enforcing multi-factor authentication - is critical. ISO 27001 ensures organisations follow the principle of least privilege, meaning attackers can't move freely through systems even if they gain access.

Why ISO 27001:2022 Matters More Than Ever

The NHS Dumfries & Galloway incident is part of a troubling trend. Just in the past year, ransomware groups have targeted:

• Southern Water, who suffered a data breach in January 2025

• Leicester City Council, breached in late 2024

• Multiple GP practices, facing system lockdowns across England and Wales

As attacks grow more frequent and sophisticated, ISO 27001 certification isn’t just a competitive advantage - it’s becoming a critical requirement. Whether you're in healthcare, retail, finance, or manufacturing, if you handle sensitive data, you're a target.

ISO 27001 provides the foundation to manage that risk in a structured, ongoing way - not just to meet compliance, but to build real resilience.

Take Action Before It Happens to You

At AAA Certification, we help organisations across the UK implement ISO 27001:2022 in a way that’s proportionate, practical, and effective. Certification doesn't need to be complex - with our support, you’ll gain clarity, security, and peace of mind.

Don't wait any longer. Sign up to a Certification Audit with AAA and take the first step towards achieving ISO 27001 certification.