Barts Health NHS Trust, one of the largest healthcare providers in England, has confirmed a data breach after the Clop ransomware gang stole and leaked years of patient invoice and personal data. The Trust, which runs five hospitals across London including the Royal London Hospital, discovered its files posted on the dark web in November, roughly three months after the intrusion took place in August. Officials have notified the National Cyber Security Centre and the Information Commissioner's Office and obtained a High Court order in an attempt to limit further publication of the stolen material.
What Happened
The breach traces back to an August intrusion that went undetected until the stolen files surfaced on Clop's dark web leak infrastructure in November. That gap of roughly three months meant the compromised data was already staged for extortion before the Trust became aware of it.
Barts Health NHS Trust operates five hospitals across London, including Mile End Hospital, Newham University Hospital, and the Royal London Hospital. The compromised database was not limited to Barts patients: it also held files tied to accounting services the Trust provided to a separate NHS Trust, widening the blast radius beyond a single organization.
In response, Barts Health sought a High Court order to prevent further publication or misuse of the exposed data. The Trust has acknowledged that the practical effect of such orders is limited against a criminal group operating outside UK jurisdiction, and that the potential for continued exploitation of the leaked data remains.
What Was Taken
The stolen data consists primarily of invoices spanning several years. Those invoices contain the full names and home addresses of individuals who received treatment or services at Barts Health hospitals. Because the records reach back over multiple years, the exposure covers not just current patients but also former patients, former employees, and suppliers who did business with the Trust.
The Trust has stated that the attack did not reach patient clinical records or core clinical systems, and it expressed confidence in the security of its central IT infrastructure. Even so, the combination of full names, addresses, and billing history is more than enough raw material for targeted fraud and social engineering against affected individuals.
Why It Matters
Healthcare organizations remain among the most attractive targets for financially motivated threat actors because they hold dense, long-lived personal data and operate under intense pressure to restore services. This incident shows that even when clinical systems are spared, the administrative and financial side of a health system carries data that is directly weaponizable against patients.
The three-month detection gap is the most important lesson for defenders. An intrusion in August that only became visible when the data appeared on a leak site in November means the theft, staging, and exfiltration all completed without triggering an alert. Clop's model does not rely on encrypting systems and demanding a decryption key; it relies on quiet bulk theft followed by public extortion, which makes detection of exfiltration the decisive control.
The Attack Technique
The breach is part of Clop's broader campaign exploiting CVE-2025-61882, a critical vulnerability in Oracle's E-Business Suite. Clop weaponized the flaw as a zero-day, using it to conduct mass data-theft attacks against organizations worldwide rather than deploying traditional file-encrypting ransomware.
The same campaign has claimed a range of high-profile victims across sectors, including Envoy Air, Harvard University, and several other prominent universities. The pattern is consistent: exploit the Oracle E-Business Suite flaw, exfiltrate large volumes of data from back-office and financial systems, then extort victims by threatening publication on Clop's leak site. Barts Health's exposure of invoice and accounting data fits squarely within that operational playbook.
What Organizations Should Do
- Patch or mitigate CVE-2025-61882 across all Oracle E-Business Suite deployments immediately, and treat any internet-exposed EBS instance as a priority asset for review.
- Hunt retroactively for signs of compromise dating back to at least August, since Clop's dwell time in this campaign has repeatedly exceeded three months before discovery.
- Prioritize detection of large outbound data transfers and anomalous access to financial and billing databases, not just endpoint encryption events, because Clop steals rather than encrypts.
- Segment administrative, accounting, and billing systems from clinical infrastructure so that a back-office compromise cannot pivot into care-delivery systems.
- Review and tighten Identity and Access Management, enforcing least privilege and strong authentication around ERP and finance platforms that aggregate sensitive personal data.
- For affected individuals: review invoices from Barts Health, stay alert for suspicious calls, letters, or emails referencing your treatment or billing details, and treat any unexpected request for personal or financial information as a likely fraud attempt.
Sources: Barts Health NHS Data Breach: Clop Ransomware Exposes Patient Invoices (2026)