{
	"id": "bb846579-c1ef-44f0-8daa-8990d56c8d02",
	"created_at": "2026-04-06T00:15:40.046345Z",
	"updated_at": "2026-04-10T03:20:34.571695Z",
	"deleted_at": null,
	"sha1_hash": "c54a137c1d68582afde474b38e53919c1fcb94fc",
	"title": "Cyber gangsters hit UK medical firm poised for work on coronavirus with Maze ransomware attack",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 193676,
	"plain_text": "Cyber gangsters hit UK medical firm poised for work on\r\ncoronavirus with Maze ransomware attack\r\nBy Bill Goodwin\r\nPublished: 2020-03-22 · Archived: 2026-04-05 14:38:49 UTC\r\nCyber gangsters have attacked the computer systems of a medical research company on standby to carry out trials\r\nof a possible future vaccine for the Covid-19 coronavirus.\r\nThe Maze ransomware group attacked the computer systems of Hammersmith Medicines Research (HMR),\r\npublishing personal details of thousands of former patients after the company declined to pay a ransom.\r\nThe company, which carried out tests to develop the Ebola vaccine and drugs to treat Alzheimer’s disease,\r\nperforms early clinical trails of drugs and vaccines.\r\nThe cyber crime group published HMR’s medical files only days after the Maze crime group made a public\r\npromise not to attack medical research organisations during the coronavirus pandemic.\r\nHMR said that IT staff discovered a “severe attack” in progress on Saturday 14 March, but were able to halt it and\r\nrestore its computer systems and email by the end of the day.\r\n“We repelled [the attack] and quickly restored all our functions. There was no downtime,”said Malcolm Boyce,\r\nmanaging and clinical director and doctor at HMR, adding that the organisation had “beefed up” its defences\r\nsubstantially.\r\nThe hacking group published a notice on a website claiming it had attacked the company with ransomware on 14\r\nMarch.\r\nIt stepped up pressure on the organisation 21 March by publishing historic sensitive medical and personal\r\ninformation about thousands of former patients on the internet.\r\nThe files, which HMR said are likely to date back 8 to 20 years, contain medical questionnaires, copies of\r\npassports, driving licenses and national insurance numbers of more than 2,300 of the organisation’s patients.\r\nComputer Weekly has established that the documents, which represent a sample of HMR former patients chosen\r\nwith surnames beginning G, I and J, include at least one copy of a currently valid passport.\r\nRansom demand\r\nBoyce said that the hackers had sent the company medical files of former patients which were 8 to 20 years old as\r\nproof they had gained access to the company’s data, along with a ransom demand.\r\nHe said that most of the sample files sent to HMR contained details of young people who had taken part in clinical\r\ntrials while travelling and would be difficult to trace.\r\nhttps://www.computerweekly.com/news/252480425/Cyber-gangsters-hit-UK-medical-research-lorganisation-poised-for-work-on-Coronavirus\r\nPage 1 of 5\n\n“What they have sent us was 8 to 20 years old, and we would not know how to contact them. They are probably\r\nyoung people who have mostly returned to their country of origin,” he said. “They are from Australia and South\r\nAfrica, which were frequent visitors to this country at at this time, and took part in clinical trials.”\r\nBoyce said he was aware that the hackers had released further records on the internet, but had not seen their\r\ncontent.\r\nThe research company is not a pharmaceutical company and does not have the funds to pay a ransom demand\r\neven it wanted to, Boyce told Computer Weekly.\r\n“We have no intention of paying. I would rather go out of business than pay a ransom to these people,” he said.\r\nMaze breaks promise not to attack medical organisations\r\nThe Maze group, which first came to notice in May 2019, extorts victims by encrypting the files of an\r\norganisation and demanding a ransom payment to release the files.\r\nIt upped the ante in late 2019 by naming companies on websites that refused to pay ransoms, and publishing\r\ndocuments and data stolen from their computer networks.\r\nMaze’s statement on 18 March\r\nThe group made a public promise in a ‘press release’ on 18 March not to attack medical organisations during the\r\ncoronavirus outbreak.\r\n“Due to [the] situation with incoming global economy crisis and virus pandemiс, our team decided to help\r\ncommercial organisations as much as possible. We are starting exclusive discounts season for everyone who have\r\nfaced our product,” it said.\r\n“We also stop all activity versus all kinds of medical organisations until the stabilisation of the situation with the\r\nvirus.”\r\nCriminals ‘only interested in money’\r\nhttps://www.computerweekly.com/news/252480425/Cyber-gangsters-hit-UK-medical-research-lorganisation-poised-for-work-on-Coronavirus\r\nPage 2 of 5\n\nRaj Samani, chief scientist at computer security specialist McAfee, said that Maze’s apparent reversal of its policy\r\nnot to attack medical intuitions shows that the criminals’ only focus was making money.\r\n“We have had previous assertions from other ransomware groups that they aren’t going to go after medical\r\nenvironments, but it really shows us we can’t take what these individuals say as trustworthy,” he said.\r\nHMR’s Boyce said: “They are unscrupulous individuals and they are pretending now that there is an amnesty\r\nbecause of the Covid-19 virus.”\r\n“They are pretending now that there is an amnesty because of the Covid-19 virus”\r\nMalcolm Boyce, HMR\r\n.\r\nHMR has not disclosed how the Maze group gained access to its network, but the hacking group frequently relies\r\non Exploit kits, which contain software designed to attack known software vulnerabilities to penetrate company\r\ndefences.\r\nThe hacking group has also used phishing emails to deliver malware to employees who may be tricked into\r\ndownloading malicious software.\r\nTroy Mursch, chief research officer at threat intelligence company Bad Packets, said that historical data showed\r\nthat Hammersmith Medicines Research used a Fortinet VPN server, which may have had a vulnerability that Maze\r\ncould have exploited.\r\nBrett Callow, threat analyst at security company Emsisoft, said that Maze had initially mis-attributed the leaked\r\nfiles from HMR to another company, which may suggest that Maze attacked a datacentre used by HMR and other\r\ncompanies.\r\n“I can’t help but wonder whether they’ve got their hooks into one or more datacentres that haven’t properly\r\nisolated their clients’ networks,” said Callow. “If companies were more open about these incidents, it may be\r\npossible to get a handle on what they’re doing, which could help other companies avoid being hit.”\r\nICO and NCA making enquiries\r\nhttps://www.computerweekly.com/news/252480425/Cyber-gangsters-hit-UK-medical-research-lorganisation-poised-for-work-on-Coronavirus\r\nPage 3 of 5\n\nHMR has reported the incident to the Information Commissioner’s Office (ICO), which told Computer Weekly\r\nthat it is making enquires.\r\nAn ICO spokesperson said: “People’s medical data is highly sensitive information, not only do people expect it to\r\nbe handled carefully and securely, organisations also have a responsibility under the law.\r\n“When a data breach occurs, we would expect an organisation to consider whether it is appropriate to contact the\r\npeople affected, and to consider whether there are steps that can be taken to protect them from any potential\r\nadverse effects.”\r\nA spokesperson from the National Crime Agency said: “We are aware of an incident affecting Hammersmith\r\nMedicines Research Limited. We are working with partners to support the organisation and understand the impact\r\nof the incident.”\r\nSoftware companies offer help\r\nComputer security companies have offered to assist medical research companies and hospitals fighting\r\nransomware attacks during the Covid-19 outbreak.\r\nEmsisoft said it had teamed up with Coveware to offer free help to healthcare providers affected by ransomware\r\nduring the coronavirus crisis, including threat analysis, development of decryption tools, and – as a last resort –\r\nnegotiating with cyber attackers.\r\nHMR\r\nHMR is on standby to test vaccines for the coronavirus\r\nhttps://www.computerweekly.com/news/252480425/Cyber-gangsters-hit-UK-medical-research-lorganisation-poised-for-work-on-Coronavirus\r\nPage 4 of 5\n\nSamani said that McAfee would assist any organisation that is having to fight on the front line, trying to find a\r\nvaccine or trying to combat Covid-19.\r\n“Anyone that does have ransomware, we will do everything to try to get them online as quickly as possible,” he\r\nsaid.\r\nBoyce said that HMR was on standby for testing possible vaccines to the coronavirus when they are ready. “We\r\nfully expect to be involved in that when they appear,” he added.\r\nUpdate of Maze statement\r\nFollowing publication of this story, the Maze ransomware group has removed more than 2,300 highly sensitive\r\nmedical files from former patients of Hammersmith Medicines Research (HMR) from its website.\r\nThe group said in a press release on 22 March that it had attacked HMR on the 14 March before it publicly\r\npromised not to attack medical institutions on 18 March, though it was silent on why it published HMR’s patient\r\nmedical files on 22 March.\r\nMaze’s statement, published within two hours of Computer Weekly’s report, attacked computer security\r\nprofessionals failing to do their jobs, who Maze claimed “prefer to chat in social networks or watch porn”.\r\nThe group claimed the companies were earning billions of dollars from the internet, but did not care about\r\nprotecting privacy. “The only thing [they] care about is to avoid lawsuits and fines for loosing that information,”\r\nsaid Maze.\r\n“We want to show that the system is unreliable. The cyber security is weak. The people who should care about the\r\nsecurity of information are unreliable. We want to show that nobody cares about the users,” the group said.\r\nMaze compared its actions to the actions of Julian Assange and Edward Snowden, warning that further attacks\r\nwould follow.\r\n“Now it’s our turn. We will change the situation by making irresponsible companies to pay for every data leak.\r\nYou will read about our successful attacks in the news more and more,” it added.\r\nAdditional research by Matt Fowler.\r\nSource: https://www.computerweekly.com/news/252480425/Cyber-gangsters-hit-UK-medical-research-lorganisation-poised-for-work-on-Coro\r\nnavirus\r\nhttps://www.computerweekly.com/news/252480425/Cyber-gangsters-hit-UK-medical-research-lorganisation-poised-for-work-on-Coronavirus\r\nPage 5 of 5",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://www.computerweekly.com/news/252480425/Cyber-gangsters-hit-UK-medical-research-lorganisation-poised-for-work-on-Coronavirus"
	],
	"report_names": [
		"Cyber-gangsters-hit-UK-medical-research-lorganisation-poised-for-work-on-Coronavirus"
	],
	"threat_actors": [],
	"ts_created_at": 1775434540,
	"ts_updated_at": 1775791234,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/c54a137c1d68582afde474b38e53919c1fcb94fc.pdf",
		"text": "https://archive.orkl.eu/c54a137c1d68582afde474b38e53919c1fcb94fc.txt",
		"img": "https://archive.orkl.eu/c54a137c1d68582afde474b38e53919c1fcb94fc.jpg"
	}
}