The National Health Laboratory Service, which provides diagnostic pathology for roughly 80 percent of South Africa's population across more than 250 laboratories, was struck by ransomware in the early hours of 22 June 2024. Parts of its infrastructure were encrypted and the organisation shut down IT systems, including email, its website and the laboratory information system that returns results to clinicians.
Sections of the NHLS environment were deleted, including on its backup server, meaning damaged components had to be rebuilt rather than simply restored. Laboratories stayed open and continued processing clinical samples, but automated report generation and the web portal doctors use to retrieve results were unavailable. Urgent results were relayed to requesting clinicians by telephone.
The effects were felt across public health facilities nationally. By early July, Techpoint Africa reported a backlog of more than 6.3 million unprocessed tests, with operations postponed and intensive care units affected. The disruption arrived while the country was monitoring an mpox outbreak.
The NHLS said a preliminary investigation found that no patient information had been compromised and that all patient data was safe. It activated an incident response team of internal specialists and external cybersecurity experts, added further security layers and deliberately kept some systems offline for repair. It gave no restoration timeline at first, saying only that rebuilding would take time, and later indicated that recovering the affected data would take several weeks.
Sources
- National Health Laboratory Service hit by cyber attackSAnews (South African Government News Agency)
- Cyber attack on South Africa's laboratory service puts healthcare at riskTechpoint Africa
- South Africa's national health lab hit with ransomware attack amid mpox outbreakThe Record
- Ransomware attack on blood-testing service puts lives in danger in South AfricaBitdefender HotForSecurity