In the wake of a cyberattack in June, South Africa’s principal medical testing agency, the National Health Laboratory Service (NHLS), has committed to restoring certain operations by mid-July. The NHLS, which encountered a significant ransomware incident, has been working diligently to bring its systems back to full functionality.
The organization’s spokesperson has directed inquiries to a July 3rd announcement, which remains the current recovery timeline. Amidst this, the NHLS has implemented various measures to continue delivering test results to healthcare providers nationwide.
Restoring the WebView portal, a critical tool for medical professionals to access test outcomes, remains a work in progress. Consequently, the NHLS has resorted to telephonic communication for urgent test results and issued a list of essential tests to medical facilities to manage the demand and maintain laboratory operations. This list is not exclusive, and routine tests are still being processed.
NHLS CEO Koleka Mlisana emphasized the gravity of the breach, highlighting its impact on public health safety. The disruption has hindered the response to several ongoing health emergencies, including mpox, HIV, and tuberculosis.
To mitigate the situation, the NHLS has devised alternative methods to provide historical data on TB and HIV viral loads to clinicians, with a focus on tests deemed critical.
The crisis unfolded on June 22nd when a cybercriminal group targeted the NHLS, which operates 265 labs serving about 80% of the South African population. The attack led to the deletion of significant data, including backups, causing over 6.3 million blood tests to remain unprocessed and delaying major medical procedures.
Manual processes have temporarily replaced electronic systems for sample registration and result dissemination. The NHLS is actively developing a new electronic system to streamline these processes.
Authorities have been alerted to the data breach, and the NHLS is cooperating with law enforcement investigations.
The BlackSuit ransomware group, previously known as Royal, has claimed responsibility for the attack, alleging the theft of extensive data and accusing the NHLS of ignoring ransom demands. The same group has recently disrupted a major automotive dealership network, continuing its pattern of high-profile cyberattacks.
