Medical centre in Northampton has email address compromised as patient receives scam

A medical centre has had its main email address compromised as a ‘small number’ of patients have received a scam email.

Emails were sent from Brook Medical Centre’s ‘reception’ email address on Saturday (May 30) and Sunday (May 31).

The NHS’ digital team has looked into the incident and its investigation suggests this was an isolated incident.

However, one patient of the Ecton Brook Road GP surgery, who wishes to remain anonymous, is now threatening to sue the medical centre as he is concerned about his personal details being compromised.

The first email that the patient received said ‘read before Sunday’, with a hyperlinked click through button, as well as his full name, date of birth and email address.

Similarly, the second email also contained another hyperlinked click through button and personal details.

He is also worried that some of his medical records may have been disclosed.

After clicking on the link in the first email, the patient believes his personal identity data and secure passwords could be at risk.

As well as threatening to sue the surgery for breach of data protection, he has reported the issues to the Information Commissioner and the police, and he does not believe the matter is concluded.

Once the emails were reported, NHS Digital’s cyber security operations centre initiated security processes and began investigations.

An NHS Digital spokeswoman said: “Following our investigation on a report of a compromised NHSmail account, we can confirm that there have been malicious emails sent from that account to external recipients (including a small number of patients of the affected organisation) between Saturday 30 May and Sunday 31 May.

“We worked with the organisation to isolate the account and can confirm that the issue has been resolved.

“Our investigation suggests this was an isolated incident.

“These events are extremely rare and we would encourage all patients to practice safe cyber habits upon receiving an unexpected email from any NHS or care organisation, including not following links, checking with the place of care that the email is genuine and reporting suspicious activity to them so that we can investigate.

“We continue to monitor all 1.41 million NHSmail accounts for suspicious activity and proactively take steps to ensure the safety of patient data to the high standards that NHSmail users expect.”

A spokeswoman for Northamptonshire Police confirmed it was also reported to the force.

She said: “This was reported to us on May 30 at about 5.15pm whereby a man received a malicious email from an email address linked to a medical centre.

“We are looking into it and are in the early stages of investigating.”

Any patients affected by the email scam will be contacted by the medical centre.

A message from the Editor:

Thank you for reading this story on our website. While I have your attention, I also have an important request to make of you.

In order for us to continue to provide high quality and trusted local news on this free-to-read site, I am asking you to also please purchase a copy of our newspaper when you do your weekly shop.

Our journalists are highly trained and our content is independently regulated by IPSO to some of the most rigorous standards in the world. But being your eyes and ears comes at a price. So we need your support more than ever to buy our newspapers during this crisis.

With the coronavirus lockdown having a major impact on many of our local valued advertisers - and consequently the advertising that we receive - we are more reliant than ever on you helping us to provide you with news and information by buying a copy of our newspaper.

Thank you