Cyber Incident Victim: National Health Service
Date:
Feb 2014
Location:
United Kingdom
Summary
The UK National Health Service website was compromised when malicious code was injected into hundreds of pages, redirecting visitors to malware distribution sites and fraudulent advertisements. Attackers exploited a coding error to insert scripts mimicking legitimate domains, using a deceptive URL (googleaspis.com) to disguise malicious activity. Initial reports indicated over 800 affected pages, prompting public advisories to avoid the site while technical teams worked to resolve the issue. Subsequent analysis revealed the incident stemmed from external manipulation of a vulnerability rather than a direct breach of the organization's systems.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The United Kingdom's National Health Service (NHS) website (nhs.uk) experienced a significant security incident on February 3, 2014, when malicious actors compromised hundreds of its web pages. Attackers injected malicious code across the platform, with initial reports identifying nearly 600 affected pages that later expanded to 836 compromised URLs. The injected scripts contained typosquatted domains designed to mimic legitimate services, notably using "googleaspis.com" instead of the valid "googleapis.com" address. This malicious infrastructure redirected visitors to websites hosting malware or unwanted advertisements. The infection was first identified and publicly reported by Reddit user Muzzers, who compiled and shared an evolving list of compromised NHS pages. The scale of page modifications suggested widespread unauthorized access to the website's content management systems or underlying infrastructure.
NHS representatives acknowledged the security issue through multiple channels following its public disclosure. Organizational staff contacted Muzzers directly via email to discuss remediation efforts while simultaneously issuing a public statement through the NHS Choices Twitter account. Their social media communication advised visitors to avoid the compromised website until repairs were completed, citing active work to resolve the technical vulnerabilities. Subsequent investigation revealed the initial breach characterization as inaccurate, with forensic analysis determining that cybercriminals had exploited a coding error within the NHS web infrastructure rather than achieving unauthorized system access through conventional hacking methods. This distinction emerged after containment efforts were already underway, though the technical specifics of the coding flaw weren't detailed in public communications. The incident caused measurable disruption to public access of healthcare information through official channels during the active compromise window.