Alder Hey Children’s Hospital confirms hackers gained access to patient data through digital gateway service
Europe’s busiest children’s hospital confirmed attackers were able to steal data from a compromised digital gateway service


Alder Hey Children’s Hospital Trust has confirmed it has suffered a data breach after sensitive information including medical records was published on the dark web and shared on social media.
The trust updated its previous statements to confirm that it suffered a single cyber incident where threat actors were able to gain unlawful access to sensitive data through a digital gateway service.
The trust said the exposure has impacted patients from three facilities in the Liverpool area, with hackers able to steal data from Alder Hey Children’s NHS Foundation Trust, Liverpool Heart and Chest Hospital, and Royal Liverpool University Hospital (RLUH).
The trust has launched an investigation into the incident, which it says is still ongoing, to determine the specific details of the intrusion and establish exactly what types of data were taken.
According to the trust’s website, it provides care to more than 450,000 young people each year and employs over 4,000 staff, making it one of Europe's biggest and busiest children’s hospitals.
Liverpool Heart and Chest Hospital is relatively smaller, with just over 100,000 patients each year, including virtual appointments.
RLUH is the largest hospital in the region, caring for over 750,000 patients each year, although Alder Hey’s statement clarified that the incident only impacted a “small amount of data from Royal Liverpool University Hospital".
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
No hospital services were affected and continue to operate, with patients advised to continue attending appointments as they normally would do so.
“As part of our response to this threat we have made progress in securing impacted systems and ensuring the attackers do not have continued access. This means that we are in a position to begin to reconnect our systems when it is safe to do so,” the statement clarified.
The incident first came to light on 28 November after the threat actor Inc Ransom posted on its dark web leak site, claiming to have stolen sensitive patient records from Alder Hey.
RELATED WHITEPAPER
Alder Hey said it is still trying to establish whether or not the attacker did, in fact, obtain confidential data, but warned this process could take a while.
“We are continuing to take this issue very seriously while investigations continue into whether the attacker has obtained confidential data. The investigation into the data may take some time, and there is a possibility that the attacker may publish the data before our investigation is concluded.”
Solomon Klappholz is a former Staff Writer at ITPro adn ChannelPro. He has experience writing about the technologies that facilitate industrial manufacturing which led to him developing a particular interest in IT regulation, industrial infrastructure applications, and machine learning.
-
Security experts issue warning over the rise of 'gray bot' AI web scrapers
News While not malicious, the bots can overwhelm web applications in a way similar to bad actors
By Jane McCallion Published
-
Does speech recognition have a future in business tech?
Once a simple tool for dictation, speech recognition is being revolutionized by AI to improve customer experiences and drive inclusivity in the workforce
By Jonathan Weinberg Published
-
NHS supplier hit with £3m fine for security failings that led to attack
News Advanced Computer Software Group lacked MFA, comprehensive vulnerability scanning and proper patch management
By Emma Woollacott Published
-
Cyber attack delayed cancer treatment at NHS hospital
News A cyber attack at Wirral University Teaching Hospital in 2024 delayed critical cancer treatment for patients, documents show.
By Nicole Kobie Published
-
Major incident declared as Merseyside hospitals hit by cyber attack
News The incident, which has led to cancelled appointments, is just the latest in a series of attacks on healthcare organizations
By Emma Woollacott Published
-
Thousands of procedures canceled at London hospitals as Qilin releases blood test data
News The attack on blood testing company Synnovis continues to affect patients, while the ransomware group follows through with its threats
By Emma Woollacott Published
-
Ransomware group threatens to publish 3TB of stolen NHS Scotland data after posting proof of attack
News NHS Dumfries and Galloway has confirmed some of the sensitive data stolen during the 15 March attack has been published by a known ransomware operator
By Solomon Klappholz Published
-
Attack on third-party software vendor disrupts NHS ambulance services
News The ambulance services serve more than 10 million people across the south of England
By Ross Kelly Published
-
NHS data leak raises ‘serious questions’ about Manchester University cyber attack
News NHS patient data used for research purposes is believed to have been compromised in the June attack
By Ross Kelly Published
-
Cyber attack on software supplier causes "major outage" across the NHS
News Unconfirmed reports suggest the attack may be ransomware-related, while the NHS contends with disrupted services on the 111 non-emergency line
By Connor Jones Published