One of the newest health care service providers in London, Barts Health NHS Trust, recently revealed what might be the first of many data breaches. Following a zero-day vulnerability in its Oracle E-Business Suite, the Cl0p Ransomware Group was able to compromise Barts Health’s automated circuitry. Files stolen from the Barts Health E-Business systems first began to leak to the dark web in November 2023, resulting in the data breach’s ex–post facto announcement by Barts Health. Barts Health NHS Trust was forced to compromise the highly confidential, sensitive data of patients, employees, past employees, and contractors.
CVE-2025-61882: A critical yet unreported vulnerability
This excess of control resulted in unauthorized access to a database of invoices, the data of which was separated and tagged that went on to include the entire identification and contact details, including credit card data of patients who had received medical assistance from one of Barts Health’s hospitals and the clinical specialists whose contracted employees had ‘overpaid’ on a salary-sacrifice plan or had remaining contributions on the clinical oversights.
The compromised database dated from April 2024 and also contained accounting data on services offered to partner institution Barking, Havering, and Redbridge University Hospitals NHS Trust. There was also data on goods and services providers. Almost a quarter of the data was publicly available and included in the compromised files.
Despite the data breach, Barts Health NHS stated that the breach did not compromise its electronic patient record or clinical systems. While the breach was claimed to be of a core IT infrastructure of the organization, it did warn those affected of the breach to be on the lookout, as the data could be used for phishing and other social engineering attacks, or for identity theft.
Barts Health’s data breach profoundly affected the organization
The breach quickly moved to the High Court to prevent the further circulation, publication, or use of the compromised data. This was meant to contain the information to prevent the more sensitive documents from being exposed on less visible parts of the internet, or the dark web.
Working with the Trust and Authorities, Barts Health exposed some of the Data breaches that affected Data from the NHS England, the National Cyber Security Centre, as well as the Metropolitan Police and the Information Commissioner’s Office, as stated in Barts Health, as well as NHS England and the other authorities, juggled the oversight and data breach to provide assistance to those affected.
A timeline of the breach
- August 2025: Cl0p exploited the Oracle zero-day and extracted invoice and accounting data. Responding to Data Breach. Data breach detection, device malfunction, or shutdown. In this event, not a single device was shut down or malfunctioned.
- November 2025: Files appeared in Cl0p’s dark web leak site and were first discovered.
- December 2025: Barts Health confirmed the data breach and took legal, operational, and security steps.
What actions are being taken?
Barts Health has indicated a multi-faceted response:
Barts Health NHS has opened a legal response concerning the Cl0p ransomware breach—the Trust has received from the High Court an injunction against the leaking of data. On the defense side, the Trust is updating Oracle systems and is collaborating with different vendors to resolve the vulnerability. Threat defense involves national law enforcement and cybersecurity working together to assess and reduce risks.
While there was no compromise of the delivery of clinical services, there is a long-lasting exposure of personal and commercially sensitive data of patients and employees, and other partners. Legal action is underway, and with the many actors now involved, Barts Health is working to control the harm, assist the impacted persons, and strengthen the immediate IT systems.
