UK Health Service Warned of Poor Security by Hacker Group

The U.K. National Health Service (NHS) said Friday that no patient data was compromised after an intrusion of one of its websites by Lulz Security, a hacker group that has recently stung organizations including a U.S. public broadcasting network and Sony.

Lulz Security apparently obtained administrative passwords for a website for a local NHS organization, according to a spokeswoman. The NHS did not reveal the name of the organization.

The NHS said that the Department of Health has previously issued security guidance to local NHS organizations on how to protect their data, and that none of its information systems had been affected by this latest incident.

Lulz, which frequently writes of its exploits on Twitter, wrote on Thursday that it had warned the NHS of the compromise by e-mail, and posted an image of the message.

"We're a somewhat known band of pirate-ninjas that go by LulzSec," the group wrote on Twitter. "While you aren't considered an enemy -- your work is of course brilliant -- we did stumble upon several of your admin passwords, which are as follows. We mean you no harm and only want to help you fix your tech issues."

The administrative passwords were blacked out in the image. On its Twitter feed, Lulz had earlier written: "Subdomain NHS access compromised 5 core admins and contact info of several affiliates. Luckily they stored nothing of importance on that DB."

Lulz Security has claimed a string of successful hacks in the past few weeks. It released what it claimed were user IDs and passwords for a MySQL database belonging to, the U.S. public broadcasting network.

Lulz also said it was responsible for hacking and releasing user names and passwords for Fox employees. Additionally, Lulz said it hit the website with a simple SQL injection attack, which yielded data such as e-mail addresses, street addresses, birthdates and passwords for some 1 million users of the site.

Send news tips and comments to

Shop ▾
arrow up Amazon Shop buttons are programmatically attached to all reviews, regardless of products' final review scores. Our parent company, IDG, receives advertisement revenue for shopping activity generated by the links. Because the buttons are attached programmatically, they should not be interpreted as editorial endorsements.

Subscribe to the Security Watch Newsletter