The U.K. National Health Service (NHS) said Friday that no patient data was compromised after an intrusion of one of its websites by Lulz Security, a hacker group that has recently stung organizations including a U.S. public broadcasting network and Sony.
Lulz Security apparently obtained administrative passwords for a website for a local NHS organization, according to a spokeswoman. The NHS did not reveal the name of the organization.
The NHS said that the Department of Health has previously issued security guidance to local NHS organizations on how to protect their data, and that none of its information systems had been affected by this latest incident.
Lulz, which frequently writes of its exploits on Twitter, wrote on Thursday that it had warned the NHS of the compromise by e-mail, and posted an image of the message.
“We’re a somewhat known band of pirate-ninjas that go by LulzSec,” the group wrote on Twitter. “While you aren’t considered an enemy — your work is of course brilliant — we did stumble upon several of your admin passwords, which are as follows. We mean you no harm and only want to help you fix your tech issues.”
The administrative passwords were blacked out in the image. On its Twitter feed, Lulz had earlier written: “Subdomain NHS access compromised 5 core admins and contact info of several affiliates. Luckily they stored nothing of importance on that DB.”
Lulz Security has claimed a string of successful hacks in the past few weeks. It released what it claimed were user IDs and passwords for a MySQL database belonging to PBS.org, the U.S. public broadcasting network.
Lulz also said it was responsible for hacking Fox.com and releasing user names and passwords for Fox employees. Additionally, Lulz said it hit the SonyPictures.com website with a simple SQL injection attack, which yielded data such as e-mail addresses, street addresses, birthdates and passwords for some 1 million users of the site.
Send news tips and comments to jeremy_kirk@idg.com