The Medical Specialist Group (MSG) in Guernsey was fined £100,000 after a 2021 cyberattack exposed sensitive patient data, which was subsequently used in phishing campaigns. The Office of the Data Protection Authority (ODPA) imposed the fine due to MSG’s significant security failures, including failing to install security updates for over a year.
The data breach at MSG
The ODPA’s investigation revealed serious and prolonged failings in MSG’s cybersecurity practices.
- Source of the breach: Criminals exploited vulnerabilities in MSG’s email server in August 2021.
- Failure to update: MSG had routinely failed to install crucial security updates to its email server over a period of 13 months, some of which directly related to the vulnerabilities used in the attack.
- Inadequate detection: The ODPA found that MSG’s threat detection software was not working properly, leading to multiple missed opportunities to detect the unauthorized access.
- Delayed reporting: The breach began in August 2021 but was not detected or reported by MSG for three and a half months, in December 2021, after patients received suspicious emails.
- Consequences: The stolen data included thousands of patient emails containing sensitive health information, such as test results and appointment details. This data was then used to launch phishing campaigns that targeted MSG patients over several months.
Regulatory action and outcome
Based on its findings, the ODPA determined that MSG had failed to take reasonable steps to secure personal data under Guernsey’s Data Protection Law.
- The ODPA regarded the contraventions as being “at the more serious end of the scale” primarily because of the highly sensitive nature of the health data that was compromised in this instance. Given the critical importance and confidentiality of such health-related information, the breaches were considered particularly severe and warranted significant concern and attention.
- Fine breakdown: The £100,000 fine was structured to encourage remediation. MSG was required to pay £75,000 upfront, with the remaining £25,000 to be waived if it completed an approved action plan within 14 months.
- Remediation efforts: Following the incident, MSG said it had made “major enhancements to its cybersecurity infrastructure”. The action plan it developed reportedly exceeded the ODPA’s expectations and included substantial investments in new technology, system monitoring, and staff training.
