{"id":3232,"date":"2025-06-25T01:39:25","date_gmt":"2025-06-25T08:39:25","guid":{"rendered":"https:\/\/www.ssls.com\/blog\/?p=3232"},"modified":"2025-06-25T01:39:27","modified_gmt":"2025-06-25T08:39:27","slug":"cyber-criminals-target-nhs-private-temping-service","status":"publish","type":"post","link":"https:\/\/www.ssls.com\/blog\/cyber-criminals-target-nhs-private-temping-service\/","title":{"rendered":"Cyber criminals target NHS private temping&nbsp;service"},"content":{"rendered":"\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/www.ssls.com\/blog\/wp-content\/uploads\/SSL_Blog_Cyber-criminals.png\" alt=\"\" class=\"wp-image-3143\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">In May 2024, cybercriminals infiltrated the systems of NHS Professionals (NHSP) and stole its Active Directory \u2014 which was never disclosed publicly by the healthcare organization.<\/p>\n\n\n\n<!--more-->\n\n\n\n<p class=\"wp-block-paragraph\">NHSP is a private arm of the Department of Health and Social Care that dispatches temporary clinical and non-clinical staff across NHS trusts in England. Currently, it has 190,000 registered healthcare professionals and over 1,000 employees working directly for the organization.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.theregister.com\/2025\/06\/12\/compromise_nhs_professionals\/\">The Register<\/a> has gained access to a Deloitte report that summarises what happened, what was stolen, and more.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How the compromise occurred<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Deloitte believes attackers broke into the system through a compromised Citrix account called LMS.Support2, though they don\u2019t know how they accessed it. Over some days, they escalated privileges to the domain administrator level and moved laterally across NHSP\u2019s network using RDP and SMB protocols&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The attackers also deployed malware such as Cobalt Strike beacons, but investigators were unsure if it was successful. After that, they used WinRM to access domain controllers and an external physical drive mapped through Citrix to extract the Active Directory database packaged as a ZIP file.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What was stolen<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">According to The Register, a spokesperson for NHSP said, &#8220;We identified and successfully dealt with an attempted cyberattack in May last year. Our cybersecurity systems and future mitigation ensured no disruption to our services, and we found that no data or other information was compromised, despite the attempt.\u201d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Contrary to the statement, though, the Active Directory, containing every user&#8217;s hashed credentials, was found to have been stolen. Some NHS insiders believe that the attackers\u2019 ultimate goal was to deploy ransomware, but fortunately, the attack never got that far.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How the attack happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Deloitte identified multiple weaknesses in the NHSP network, including:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Lack of multi-factor authentication on domain-privileged accounts.&nbsp;<\/li>\n\n\n\n<li>Poor endpoint detection and response tools<\/li>\n\n\n\n<li>Insufficient event logging that prevented proper analysis<\/li>\n\n\n\n<li>Inadequate network segmentation and excessive permissions<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Deloitte laid out essential action items the organization needed to reduce risk and increase security in its report. These items are broken down and collected into two main objectives: building cyber resilience and improving technology operational effectiveness.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The takeaway<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The NHS Professionals breach is yet another reminder that outdated or incomplete technology infrastructure can make essential industries vulnerable. In today\u2019s threat landscape organizations must invest in resilient, modern systems sooner rather than later.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In May 2024, cybercriminals infiltrated the systems of NHS Professionals (NHSP) and stole its Active Directory \u2014 which was never disclosed publicly by the healthcare organization.<\/p>\n","protected":false},"author":9,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-3232","post","type-post","status-publish","format-standard","hentry","category-news"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Cyber criminals target NHS private temping service | SSLs.com Blog<\/title>\n<meta name=\"description\" content=\"In May 2024, cybercriminals infiltrated the systems of NHS Professionals (NHSP) and stole its Active Directory \u2014 which was never disclosed publicly by the\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.ssls.com\/blog\/cyber-criminals-target-nhs-private-temping-service\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Cyber criminals target NHS private temping service | SSLs.com Blog\" \/>\n<meta property=\"og:description\" content=\"In May 2024, cybercriminals infiltrated the systems of NHS Professionals (NHSP) and stole its Active Directory \u2014 which was never disclosed publicly by the\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.ssls.com\/blog\/cyber-criminals-target-nhs-private-temping-service\/\" \/>\n<meta property=\"og:site_name\" content=\"SSLs.com Blog\" \/>\n<meta property=\"article:published_time\" content=\"2025-06-25T08:39:25+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-25T08:39:27+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.ssls.com\/blog\/wp-content\/uploads\/SSL_Blog_Cyber-criminals.png\" \/>\n<meta name=\"author\" content=\"Aideen Molloy\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Aideen Molloy\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.ssls.com\\\/blog\\\/cyber-criminals-target-nhs-private-temping-service\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ssls.com\\\/blog\\\/cyber-criminals-target-nhs-private-temping-service\\\/\"},\"author\":{\"name\":\"Aideen Molloy\",\"@id\":\"https:\\\/\\\/www.ssls.com\\\/blog\\\/#\\\/schema\\\/person\\\/ae7158292578f80604c428cc5bbe68c0\"},\"headline\":\"Cyber criminals target NHS private temping&nbsp;service\",\"datePublished\":\"2025-06-25T08:39:25+00:00\",\"dateModified\":\"2025-06-25T08:39:27+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.ssls.com\\\/blog\\\/cyber-criminals-target-nhs-private-temping-service\\\/\"},\"wordCount\":393,\"image\":{\"@id\":\"https:\\\/\\\/www.ssls.com\\\/blog\\\/cyber-criminals-target-nhs-private-temping-service\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/ssls-blog.production.cloudplatform.tech\\\/wp-content\\\/uploads\\\/SSL_Blog_Cyber-criminals.png\",\"articleSection\":[\"news\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.ssls.com\\\/blog\\\/cyber-criminals-target-nhs-private-temping-service\\\/\",\"url\":\"https:\\\/\\\/www.ssls.com\\\/blog\\\/cyber-criminals-target-nhs-private-temping-service\\\/\",\"name\":\"Cyber criminals target NHS private temping service | SSLs.com Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ssls.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.ssls.com\\\/blog\\\/cyber-criminals-target-nhs-private-temping-service\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.ssls.com\\\/blog\\\/cyber-criminals-target-nhs-private-temping-service\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/ssls-blog.production.cloudplatform.tech\\\/wp-content\\\/uploads\\\/SSL_Blog_Cyber-criminals.png\",\"datePublished\":\"2025-06-25T08:39:25+00:00\",\"dateModified\":\"2025-06-25T08:39:27+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.ssls.com\\\/blog\\\/#\\\/schema\\\/person\\\/ae7158292578f80604c428cc5bbe68c0\"},\"description\":\"In May 2024, cybercriminals infiltrated the systems of NHS Professionals (NHSP) and stole its Active Directory \u2014 which was never disclosed publicly by the\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.ssls.com\\\/blog\\\/cyber-criminals-target-nhs-private-temping-service\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.ssls.com\\\/blog\\\/cyber-criminals-target-nhs-private-temping-service\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.ssls.com\\\/blog\\\/cyber-criminals-target-nhs-private-temping-service\\\/#primaryimage\",\"url\":\"https:\\\/\\\/ssls-blog.production.cloudplatform.tech\\\/wp-content\\\/uploads\\\/SSL_Blog_Cyber-criminals.png\",\"contentUrl\":\"https:\\\/\\\/ssls-blog.production.cloudplatform.tech\\\/wp-content\\\/uploads\\\/SSL_Blog_Cyber-criminals.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.ssls.com\\\/blog\\\/cyber-criminals-target-nhs-private-temping-service\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.ssls.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cyber criminals target NHS private temping&nbsp;service\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.ssls.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.ssls.com\\\/blog\\\/\",\"name\":\"SSLs.com Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.ssls.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.ssls.com\\\/blog\\\/#\\\/schema\\\/person\\\/ae7158292578f80604c428cc5bbe68c0\",\"name\":\"Aideen Molloy\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/69e16d19dbb7f01ea23d6b22b14f31a0f057e7f7e1807cf9ff4a550eb5a2f90d?s=96&d=blank&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/69e16d19dbb7f01ea23d6b22b14f31a0f057e7f7e1807cf9ff4a550eb5a2f90d?s=96&d=blank&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/69e16d19dbb7f01ea23d6b22b14f31a0f057e7f7e1807cf9ff4a550eb5a2f90d?s=96&d=blank&r=g\",\"caption\":\"Aideen Molloy\"},\"description\":\"Aideen is a digital copywriter for SSLs.com. Having eight years of experience in online content creation, she is a versatile writer with an interest in a wide variety of topics, ranging from technology to marketing.\",\"sameAs\":[\"https:\\\/\\\/www.ssls.com\\\/\"],\"url\":\"https:\\\/\\\/www.ssls.com\\\/blog\\\/author\\\/cora-quigley\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Cyber criminals target NHS private temping service | SSLs.com Blog","description":"In May 2024, cybercriminals infiltrated the systems of NHS Professionals (NHSP) and stole its Active Directory \u2014 which was never disclosed publicly by the","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.ssls.com\/blog\/cyber-criminals-target-nhs-private-temping-service\/","og_locale":"en_US","og_type":"article","og_title":"Cyber criminals target NHS private temping service | SSLs.com Blog","og_description":"In May 2024, cybercriminals infiltrated the systems of NHS Professionals (NHSP) and stole its Active Directory \u2014 which was never disclosed publicly by the","og_url":"https:\/\/www.ssls.com\/blog\/cyber-criminals-target-nhs-private-temping-service\/","og_site_name":"SSLs.com Blog","article_published_time":"2025-06-25T08:39:25+00:00","article_modified_time":"2025-06-25T08:39:27+00:00","og_image":[{"url":"https:\/\/www.ssls.com\/blog\/wp-content\/uploads\/SSL_Blog_Cyber-criminals.png","type":"","width":"","height":""}],"author":"Aideen Molloy","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Aideen Molloy","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.ssls.com\/blog\/cyber-criminals-target-nhs-private-temping-service\/#article","isPartOf":{"@id":"https:\/\/www.ssls.com\/blog\/cyber-criminals-target-nhs-private-temping-service\/"},"author":{"name":"Aideen Molloy","@id":"https:\/\/www.ssls.com\/blog\/#\/schema\/person\/ae7158292578f80604c428cc5bbe68c0"},"headline":"Cyber criminals target NHS private temping&nbsp;service","datePublished":"2025-06-25T08:39:25+00:00","dateModified":"2025-06-25T08:39:27+00:00","mainEntityOfPage":{"@id":"https:\/\/www.ssls.com\/blog\/cyber-criminals-target-nhs-private-temping-service\/"},"wordCount":393,"image":{"@id":"https:\/\/www.ssls.com\/blog\/cyber-criminals-target-nhs-private-temping-service\/#primaryimage"},"thumbnailUrl":"https:\/\/www.ssls.com\/blog\/wp-content\/uploads\/SSL_Blog_Cyber-criminals.png","articleSection":["news"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.ssls.com\/blog\/cyber-criminals-target-nhs-private-temping-service\/","url":"https:\/\/www.ssls.com\/blog\/cyber-criminals-target-nhs-private-temping-service\/","name":"Cyber criminals target NHS private temping service | SSLs.com Blog","isPartOf":{"@id":"https:\/\/www.ssls.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.ssls.com\/blog\/cyber-criminals-target-nhs-private-temping-service\/#primaryimage"},"image":{"@id":"https:\/\/www.ssls.com\/blog\/cyber-criminals-target-nhs-private-temping-service\/#primaryimage"},"thumbnailUrl":"https:\/\/www.ssls.com\/blog\/wp-content\/uploads\/SSL_Blog_Cyber-criminals.png","datePublished":"2025-06-25T08:39:25+00:00","dateModified":"2025-06-25T08:39:27+00:00","author":{"@id":"https:\/\/www.ssls.com\/blog\/#\/schema\/person\/ae7158292578f80604c428cc5bbe68c0"},"description":"In May 2024, cybercriminals infiltrated the systems of NHS Professionals (NHSP) and stole its Active Directory \u2014 which was never disclosed publicly by the","breadcrumb":{"@id":"https:\/\/www.ssls.com\/blog\/cyber-criminals-target-nhs-private-temping-service\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.ssls.com\/blog\/cyber-criminals-target-nhs-private-temping-service\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.ssls.com\/blog\/cyber-criminals-target-nhs-private-temping-service\/#primaryimage","url":"https:\/\/www.ssls.com\/blog\/wp-content\/uploads\/SSL_Blog_Cyber-criminals.png","contentUrl":"https:\/\/www.ssls.com\/blog\/wp-content\/uploads\/SSL_Blog_Cyber-criminals.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.ssls.com\/blog\/cyber-criminals-target-nhs-private-temping-service\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.ssls.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Cyber criminals target NHS private temping&nbsp;service"}]},{"@type":"WebSite","@id":"https:\/\/www.ssls.com\/blog\/#website","url":"https:\/\/www.ssls.com\/blog\/","name":"SSLs.com Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.ssls.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.ssls.com\/blog\/#\/schema\/person\/ae7158292578f80604c428cc5bbe68c0","name":"Aideen Molloy","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/69e16d19dbb7f01ea23d6b22b14f31a0f057e7f7e1807cf9ff4a550eb5a2f90d?s=96&d=blank&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/69e16d19dbb7f01ea23d6b22b14f31a0f057e7f7e1807cf9ff4a550eb5a2f90d?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/69e16d19dbb7f01ea23d6b22b14f31a0f057e7f7e1807cf9ff4a550eb5a2f90d?s=96&d=blank&r=g","caption":"Aideen Molloy"},"description":"Aideen is a digital copywriter for SSLs.com. Having eight years of experience in online content creation, she is a versatile writer with an interest in a wide variety of topics, ranging from technology to marketing.","sameAs":["https:\/\/www.ssls.com\/"],"url":"https:\/\/www.ssls.com\/blog\/author\/cora-quigley\/"}]}},"_links":{"self":[{"href":"https:\/\/www.ssls.com\/blog\/wp-json\/wp\/v2\/posts\/3232","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ssls.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ssls.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ssls.com\/blog\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ssls.com\/blog\/wp-json\/wp\/v2\/comments?post=3232"}],"version-history":[{"count":1,"href":"https:\/\/www.ssls.com\/blog\/wp-json\/wp\/v2\/posts\/3232\/revisions"}],"predecessor-version":[{"id":3233,"href":"https:\/\/www.ssls.com\/blog\/wp-json\/wp\/v2\/posts\/3232\/revisions\/3233"}],"wp:attachment":[{"href":"https:\/\/www.ssls.com\/blog\/wp-json\/wp\/v2\/media?parent=3232"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ssls.com\/blog\/wp-json\/wp\/v2\/categories?post=3232"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ssls.com\/blog\/wp-json\/wp\/v2\/tags?post=3232"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}