Ransomware Attack on Advanced Disrupts NHS Services: Lessons for Healthcare Cybersecurity in 2026

Last week, IT partner Advanced was hit by ransomware, disrupting NHS 111 and emergency services. Recovery efforts, led by Advanced with support from NCSC and Microsoft, are ongoing with services expected to be restored in 3-4 weeks.

Ozan Ucar, Founder and CEO of Keepnet

Last Updated: 2026-06-01

Ransomware Attack on Advanced Disrupts NHS Services, Recovery Expected in 3-4 Weeks

In August 2022, Advanced, a major NHS IT provider, suffered a ransomware attack that disrupted critical health services across the UK. The attack remains one of the most significant cyber incidents ever recorded against UK healthcare infrastructure. By 2026, the attack has become a landmark case study for healthcare cybersecurity globally: the UK government subsequently enacted the Cyber Security and Resilience Bill, NHS organizations have accelerated legacy system modernization programs, and the Cyber Essentials certification has become a baseline requirement for NHS suppliers. Despite these advances, ransomware attacks on healthcare providers globally have continued to increase, with average ransom demands in healthcare exceeding $4 million by 2025.

The 2022 attack on Advanced disrupted NHS 111, out of hours appointment booking, ambulance dispatch coordination, and mental health care systems. Full restoration of all affected services took several months beyond the initial three to four week estimate. The attack exposed the NHS's structural dependency on a small number of large IT suppliers and accelerated sector-wide discussions about supply chain risk in healthcare IT. In 2026, NHS England requires all critical IT suppliers to demonstrate compliance with defined cybersecurity standards as a condition of contract, a direct policy response to the Advanced incident.

The Immediate Impact of the Attack

Advanced is responsible for multiple core systems within the NHS, with the NHS 111 service among its primary clients. As a result, the ransomware attack created bottlenecks across various healthcare services:

Patient Dispatch Delays: NHS 111, which provides urgent healthcare guidance, experienced slowdowns in dispatching patients to appropriate care facilities.
Emergency Prescriptions Affected: Prescription and medication services were also disrupted, potentially affecting timely patient care.
Ambulance and Out-of-Hours Services Delayed: Ambulance dispatch and out of hours services were disrupted, resulting in delays and strained resources in emergency care.

Given the extensive reliance of NHS operations on Advanced’s systems, these disruptions highlight a weak link that could be exploited in similar attacks.

Advanced’s Response and Recovery Plans

In the face of this breach, Advanced coordinated with specialist cybersecurity firms to investigate and remediate the attack. As of August 10, Advanced confirmed that the National Cyber Security Center (NCSC) is actively supporting the ongoing investigation. While the initial breach has been contained, restoring full system functionality for NHS services remains a multi week effort.

Timeline for Service Restoration

According to Advanced’s latest update, the company is taking a phased approach to bring critical NHS services back online. For NHS 111 and other emergency services utilizing Advanced’s Adastra system, a gradual restoration process will begin soon. Full recovery for all NHS related operations, however, may take another 3-4 weeks, and contingency plans are advised during this period.

Government Response and the Need for Resilient Cybersecurity in Healthcare

The UK government’s attempt to downplay the ransomware attack as “minimal destruction” stirred controversy, especially given the clear operational disruptions across NHS services. This highlights a broader issue: governments and healthcare providers need to adopt a proactive stance on cybersecurity. Maintaining system resilience is critical not only for IT departments but for healthcare professionals and the patients they serve.

Healthcare institutions must prioritize:

Cybersecurity Awareness Training to prepare employees for potential ransomware threats, as seen in attacks on other sectors.
Incident Response Plans to handle breaches with a rapid, coordinated response, minimizing impact on essential services.
Threat Intelligence and Monitoring to detect vulnerabilities in third party systems, such as Advanced’s platform, which can inadvertently affect an entire healthcare network.

Organizations can benefit from security awareness training to reinforce protective measures and prepare personnel for potential breaches. Advanced’s incident reflects the necessity for widespread cyber awareness and preparedness, given the frequent targeting of critical sectors by ransomware attackers.

The Importance of Contingency Plans

For NHS and other healthcare providers, the reliance on third party IT systems underscores the importance of robust contingency plans. With contingency measures in place, healthcare services can mitigate service disruptions and manage patient needs even when primary systems are compromised.

The Long Road to Full Recovery

For NHS providers, Advanced's phased recovery approach offered early reassurance, but the extended timeline to full restoration revealed how deeply embedded third party IT systems have become in healthcare delivery. In 2026, the incident continues to shape NHS supplier security requirements, incident response planning, and investment in healthcare-specific cybersecurity capabilities. Organizations that have not reviewed their supplier dependency and contingency arrangements since 2022 should treat this case as an urgent prompt to do so.

Editor's Note: This article was updated on June 1, 2026.

Schedule your 30-minute demo now

You'll learn how to:

Implement robust ransomware preparedness and protection strategies tailored for healthcare environments.

Utilize advanced contingency planning and incident response to minimize the impact of cyber disruptions.

Leverage sophisticated cybersecurity tools and human risk scoring to safeguard sensitive healthcare systems effectively.

Frequently Asked Questions

What was the ransomware attack on Advanced and how did it affect the NHS?

In August 2022, Advanced, a major IT provider for the UK's National Health Service (NHS), suffered a ransomware attack that disrupted multiple NHS systems. The most affected was NHS 111, the urgent medical helpline, which was forced to revert to manual processes for patient dispatch. Ambulance dispatch, out of hours appointment booking, and mental health services were also disrupted. Advanced provides IT systems to a significant portion of NHS organizations, meaning a single attack on one supplier created cascading failures across the health service.

Why is healthcare a prime target for ransomware attacks?

Healthcare organizations are prime ransomware targets because they cannot afford significant downtime: patient safety depends on continuous access to records and systems. This operational pressure makes healthcare organizations more likely to pay ransoms quickly. Additionally, healthcare data is highly sensitive and valuable for identity theft and insurance fraud. Many healthcare IT systems run legacy software that is difficult to patch, and the sector has historically underinvested in cybersecurity relative to its risk profile.

How long did recovery from the Advanced ransomware attack take?

Advanced estimated that full recovery would take three to four weeks for critical systems, with some services taking longer. The company took a phased approach, prioritizing the restoration of emergency services such as NHS 111 and ambulance dispatch before less critical systems. Some services remained on manual or contingency procedures for an extended period beyond the initial estimate. The attack demonstrated that healthcare ransomware incidents typically have longer recovery timelines than the initial estimates suggest.

What is a third party IT provider risk and how did it apply here?

Third party IT provider risk refers to the vulnerability that arises when an organization depends on an external supplier for critical systems. When the supplier is compromised, the customer organization loses access to those systems without necessarily having been attacked directly. In the Advanced case, NHS organizations that relied on Advanced's hosted software lost access to patient management, dispatch, and scheduling systems because their supplier was encrypted. This illustrates why organizations must assess and manage the cybersecurity posture of their IT suppliers, not just their own systems.

What should healthcare organizations do to prepare for ransomware incidents?

Healthcare organizations should maintain tested offline backups of critical systems that can be restored independently of a compromised supplier; develop and regularly test contingency procedures for operating without key IT systems; ensure staff are trained to recognize phishing and social engineering attacks, which are the most common ransomware entry points; implement multi factor authentication on all remote access; and have a tested incident response plan that includes supplier failure scenarios. Keepnet's Security Awareness Training helps healthcare staff recognize the phishing tactics most commonly used to initiate ransomware infections.

What is the UK government's role in responding to NHS cyber attacks?

The UK government coordinates NHS cybersecurity responses through the National Cyber Security Centre (NCSC), which provides technical assistance during major incidents, the Department of Health and Social Care, and NHS England. In the Advanced attack, the NCSC worked alongside Advanced and its specialist partners to support recovery efforts. The government's initial characterization of the attack as causing minimal destruction was later contradicted by frontline NHS workers reporting significant operational impacts, illustrating the importance of transparent communication during major incidents.

How does ransomware enter NHS and healthcare IT systems?

Ransomware most commonly enters healthcare systems through phishing emails that trick employees into clicking malicious links or opening infected attachments, exploitation of unpatched vulnerabilities in internet facing systems, compromised remote access credentials obtained through credential stuffing or brute force, and supply chain compromises where a trusted supplier's systems are used as an entry point. The combination of large employee populations, legacy systems, and high operational pressure to avoid downtime makes healthcare particularly susceptible to these entry vectors.

What are contingency plans and why are they critical for NHS providers?

Contingency plans are documented procedures for maintaining critical operations when normal systems are unavailable. For NHS providers, contingency plans cover how to manage patient dispatch, prescriptions, and appointment booking without electronic systems. The Advanced attack demonstrated that contingency plans must be regularly tested and kept current: staff who have not practiced manual procedures recently will struggle to execute them under the pressure of a real incident. Plans must also account for extended outages, as the Advanced recovery took weeks rather than hours.

What is the financial impact of ransomware attacks on healthcare providers?

Ransomware attacks on healthcare providers cause costs across multiple categories: ransom payments if made; system restoration and forensic investigation costs; operational losses from reduced capacity during outages; regulatory fines if data was improperly handled or breach notifications were delayed; legal costs; and reputational damage that can affect contracts and patient trust. For NHS providers, the costs also include the public health impact of delayed care, which is harder to quantify but potentially the most significant consequence.

How can phishing simulation training help healthcare organizations reduce ransomware risk?

Because phishing is the most common initial access vector for healthcare ransomware, training employees to recognize and report suspicious emails directly reduces the likelihood of a successful ransomware deployment. Phishing simulation training sends realistic phishing emails to healthcare staff, measures response behavior, and delivers immediate feedback. Over time, this builds the recognition skills and reporting habits that can stop a ransomware infection before it begins.