COI Report – Part III
Page
69 of
425 Figure 11: Data exfiltration route 201. IHiS simulated the queries executed by the attacker and was able to approximate the data volume of the results. This was compared against data on the outgoing network traffic from Workstation A to an overseas C server from
27 June 2018 to 4 July 2018. The two data-sets clearly correspond to each other, and strongly indicates that part of the outgoing data contained the patient records accessed by the attacker.
202. IHiS has also confirmed that the size of the database query returns corresponds to the approximate size of 1.5 million patients personal particulars and 159,000 outpatient dispensed medication records.
203. There is no evidence to show that patient
records had been amended, deleted, or otherwise tampered with. Similarly, there is no evidence
that other patient records, such as diagnoses, test results,
or doctors notes, were accessed. There was no disruption to healthcare services and patient care was not compromised.
204. The copying and exfiltration of data from the SCM database was stopped on 4 July 2018, after staff from IHiS discovered the unusual queries and took steps to prevent any similar queries from being run against the SCM database.
Share with your friends: 
