Cyber attack targeted nearly 33k patients at Bedfordshire Hospitals Trust
The trust which runs both Bedford Hospital and Luton & Dunstable Hospital has suffered a major ransomware cyber-attack.
The data security breach happened in June 2024 when an organisation which provides essential services to the trust and other healthcare bodies was targeted.
The trust revealed the news on its website today (Tuesday) in a lengthy post and said: “During the attack, criminals unlawfully accessed internal systems and extracted a set of files, which were later published on online forums known for sharing stolen data.
"In October 2025, the supplier informed us that some data relevant to our organisation was included in the material they had recovered and analysed. We have since undertaken our own review of that material.”
And because it wasn’t organised as a single database it has taken more than a year of analysis by specialist teams to understand what info was present and which organisations it related to.
But perhaps more worryingly, the data provided appears to relate to 32,927 patients and could include their name, date of birth, NHS number, postcode – and test results from over five years ago, prior to November 2020.
Who is affected?
It’s possible the data relates to patients who had laboratory or diagnostic results at Bedford Hospital or Luton and Dunstable Hospital between 2011 and 2020.
What this means for you
The hospital trust believes the risk of the data being misused is low because it is fragmented and historic and says the supplier is continuing to monitor online forums where the material was published.
It’s also got a court injunction prohibiting third parties from accessing, sharing, publishing or misusing the stolen data.
The trusts’ statement added: “While the data remains present in those places, publication alone does not mean that it has been used in a harmful way. At this time, we are not aware of any evidence that the information has been accessed or used inappropriately. However, as a precaution, there remains a limited risk of unsolicited contact or phishing attempts.”
What you can do?
Remain alert to any unexpected communications asking for personal information
Avoid clicking on links or opening attachments from unknown sources
Be cautious of unsolicited calls, emails or texts that reference your information
Don’t forget, the hospital will never contact you to ask for your password or sensitive personal information such as bank details or security codes.