Names and addresses of individuals who were liable to pay for treatment or services at a Barts Health hospital over several years were stolen by Russian-speaking ransomware group Cl0p, reports Marco Marcelline

Barts Health NHS Trust has sought a High Court order to prevent the wide release of patient and staff data stolen from its servers by Russian-speaking ransomware group Cl0p.

Cl0p, who have extorted over $500million in ransom payments globally since 2019, exploited a loophole in the Oracle E-Business suite software to steal files from a Barts database containing invoices.

The stolen files include names and addresses of individuals who were liable to pay for treatment or services at a Barts Health hospital over several years.

Barts, which manages Whipps Cross Hospital, however stated that electronic patient records and clinical systems “are not affected” by the breach, insisting that its core IT infrastructure “remained secure”.

The theft occurred in August 2025 but it was only noticed in November when the files were posted on the dark web, Barts admitted.

Explaining who was impacted by the breach, the trust stated: “Some former staff members are listed [in the database] because they left employment owing the trust for salary sacrifice or overpayment. Almost half of the potentially compromised files list suppliers of goods or services whose details are in the public domain.

“The database also includes files relating to accounting services we provided since April 2024 to Barking, Havering and Redbridge University Hospitals NHS Trust. We are working with them to minimise the harm to those affected.

“To date no information has been published on the general internet, and the risk is limited to those able to access compressed files on the encrypted dark web.”

The NHS trust added: “We are very sorry that this has happened and are taking steps with our suppliers to ensure that it could not happen again.”

Barts has informed the National Cyber Security Centre, the Metropolitan Police, and the Information Commissioner’s Office (ICO) about the incident.

No news is bad news

Independent news outlets like ours – reporting for the community without rich backers – are under threat of closure, turning British towns into news deserts.

The audiences they serve know less, understand less, and can do less.

If our coverage has helped you understand our community a little bit better, please consider supporting us with a monthly, yearly or one-off donation.

Choose the news. Don’t lose the news.

Monthly direct debit

Annual direct debit

£5 per month supporters get a digital copy of each month’s paper before anyone else, £10 per month supporters get a digital copy of each month’s paper before anyone else and a print copy posted to them each month. £50 annual supporters get a digital copy of each month's paper before anyone else.