AnoaGhost

Profile narrative

AnoaGhost is the alias used by the threat actor responsible for the 2018 defacement of a United Kingdom National Health Service website. The actor is associated with Indonesia, which is the only location publicly linked to the moniker. The target was the insights.london.nhs.uk site, which hosts patient survey data concerning primary care providers such as general practitioner surgeries. The action taken by the actor constituted a disruption‑oriented defacement rather than a financially motivated or espionage‑driven operation. The defacement presented a black background, played eerie music and displayed white text that read “Hacked by AnoaGhost.” Security researcher Kevin Beaumont observed the altered page, captured a screenshot and shared it on Twitter, bringing the issue to wider attention. The altered content remained visible for several hours before the site owners removed the offending material.

The compromised page, according to a cached version available online, had shown the defacement for at least five days, although the NHS has not confirmed that exact timeframe. After the BBC contacted NHS Digital, the organization acknowledged the issue and confirmed that action had been taken by the site owners to eliminate the defaced elements. NHS Digital also stated that it would work with the site owner to address the underlying vulnerability that allowed the alteration. No reports indicated that patient data were exfiltrated, modified or otherwise compromised during the incident. The defacement caused a temporary interruption in public access to the primary care provider information hosted on the site, but services were restored once the malicious content was taken down. Public sources have not linked AnoaGhost to any state‑sponsored program, criminal consortium or other affiliate group, leaving the actor’s affiliations unverified. To date, the NHS website defacement remains the sole publicly documented operation attributed to the AnoaGhost moniker.

Incidents

Attributed incidents are available to members.