Cyber Threat Actor: AnoaGhost

AnoaGhost is an alias used by a threat actor. The actor is known to be based in Indonesia. On April 17, 2018, AnoaGhost defaced the NHS website insights.london.nhs.uk, which hosted data from patient surveys about primary care providers including GP surgeries. The defacement replaced the site with a black background, played eerie music, and displayed white text reading "Hacked by AnoaGhost." Cyber‑security researcher Kevin Beaumont first noticed the alteration on a Tuesday afternoon and shared a screenshot on Twitter. Beaumont’s tweet drew attention to the incident and prompted media inquiries from outlets such as the BBC. A cached version of the compromised page indicated the defacement had been present for at least five days before detection, although the NHS has not confirmed this duration. NHS Digital was contacted by the BBC regarding the defacement after the media inquiry.

An NHS Digital spokesman confirmed that action had been taken to remove the defaced content and that they would work with the site owner to fix the underlying vulnerability. The site was restored after the defaced elements were removed, ending the public display of the hacker’s message. The incident caused a temporary interruption in public access to the patient‑survey data hosted on the site. No data theft was reported as part of the defacement. No prolonged service outage extended beyond the defacement period. The BBC article published on April 17, 2018, titled "NHS website defaced by hackers," serves as the primary public source for these details. No further publicly attributed operations or affiliations have been linked to AnoaGhost in the available sources.