“We needed to find solutions to a variety of issues whilst being a complex business, operating in a 24/7 environment. Stripe OLT listened and understood immediately the challenges we faced.”

IT Operations Manager
Simon Darley
Trusted by industry leaders

Let's Talk

Call us on one of the numbers below, we cover the whole of the UK, so call the nearest office.

BriSTOL HQ & The South West

London & Surrounding Areas

Manchester & the North

“We needed to find solutions to a variety of issues whilst being a complex business, operating in a 24/7 environment. Stripe OLT listened and understood immediately the challenges we faced.”

IT Operations Manager
Simon Darley
Trusted by industry leaders

Request a Call-back.

First we need a few details.

Contact Form Primary popup

Keep up to date with the experts

Get insights direct to your email inbox

NEWSLETTER - Exit Intent

Follow us on social

“We needed to find solutions to a variety of issues whilst being a complex business, operating in a 24/7 environment. Stripe OLT listened and understood immediately the challenges we faced.”

IT Operations Manager
Simon Darley
Trusted by industry leaders

Request a Call

First we need a few details.

Contact Form Primary popup w/ Captcha
Expert Intel

Santander, Ticketmaster & NHS attacks

Published: June 7, 2024
Updated: June 13, 2024
Expert: Sam Bracey
Role: SOC Team Lead
Specialises in: Security Operations
What you will learn:
This intel covers the recent cyber attacks the NHS, Santander, and Ticketmaster, providing a detailed look into the tactics and techniques used by cyber criminal groups like Qilin and Shiny Hunters. You’ll learn how these attacks were executed and uncover practical steps that could potentially enhance your organisations internal cyber security measures.
Consider the far-reaching impact of these attacks: hospitals canceling critical operations, millions of banking details exposed, and personal data sold on the dark web. These aren’t just numbers—they represent real people facing life-altering consequences. By understanding the methods behind these attacks and implementing robust cyber security practices, you can protect your organisation from similar threats.

As you may have heard, there have been a number of high-profile Cyber Attacks covered in the media recently  – Santander, Ticketmaster, and a selection of NHS trusts in London have all experienced large scale, targeted cyber attacks.  

Naturally, we’ve had a fair amount of people asking for advice and as such, I wanted to collate some information for those that want to understand more, and potentially help a few of those that want to know what they should be doing to avoid falling victim.  

First, let’s explore the attacks that have taken place on the NHS. 

Cyber Attacks on the NHS 

Two NHS trusts have had to cancel non-emergency operations after a ransomware gang targeted Synnovis, a third-party company that provides testing services for multiple hospitals.  

Synnovis’ IT systems were completely locked out. It was theorised that Russian cyber-criminal gang ‘Qilin (Agenda)’ were behind the attack, though initial access and a root cause has yet to be disclosed – see Synnovis Statement / The Standard – NCSC Statement

Qilin target a large variety of industries,  Manufacturing, Construction, News and Entertainment, Healthcare and more.  

Their focus is generally on phishing emails that contain malicious links, after gaining initial access the threat group will move laterally through an environment searching for sensitive data locations to mark for encryption.  

During the encryption stage, the threat group places a ransomware note in each infected directory. This double extortion method causes mass disruption by locking data, providing more leverage when trying to extort victims for financial gain. See Source

This particular strain of ransomware targets VMware Esxi servers, which are used by many corporations for virtual machine hosting. A full analysis can be found here

high-level overview of the attack path: 

WHat could you do, to avoid falling victim?

  • Assess your VM infrastructure, even if you don’t use VMware, targeting virtual machines is becoming more prolific amongst ransomware operators.  
  • Continuous phishing awareness training across your organisation. 
  • Offsite immutable backups – by securely backing up your data elsewhere, you remove the leverage of ransomware operators encrypting your data.  

cyber Attacks on Santander & Ticketmaster

Santander background

A group known as ‘Shiny Hunters’ posted information on the dark web stating that they had collected data from 30 million individual bank accounts, which included account numbers, balances, credit card numbers and HR information for staff. See Source

Ticketmaster Background 

Again, ‘Shiny Hunters’ have claimed to have stolen data including names, addresses, phone numbers and partial credit card details from end users. There is estimated to be around 1.3TB of data stolen, and the threat group is reportedly attempting to sell this information for $500,000 on breach forums. See Source

Both data breaches have been highlighted as having been from the same source, a cloud platform known as ‘Snowflake’ which is widely used for data storage, processing, and analytics.  

Snowflake, and their cyber security providers CrowdStrike and

Mandiant released the following statement regarding the breach:  

We have not identified evidence suggesting this activity was caused by a vulnerability, misconfiguration, or breach of Snowflake’s platform. 

We have not identified evidence suggesting this activity was caused by compromised credentials of current or former Snowflake personnel. 

This appears to be a targeted campaign directed at users with single factor authentication. 

As part of this campaign, threat actors have leveraged credentials previously purchased or obtained through info stealing malware.”

“Credentials leveraged in the attack were previously purchased or obtained through info stealing malware, adding that Snowflake did find evidence that a threat actor obtained personal credentials to and accessed demo accounts belonging to a former employee.

See Source

Whilst we won’t know the exact attack vector until official reports are made available, based on public information it’s likely that the data breach followed the following path:  

What could you do to avoid falling victim? 

  • Continued enforcement of MFA for ALL user accounts. It should be Mandatory. SMS MFA is okay and better than nothing, but number / geo matching should be the standard and enforced.  
  • Ongoing training regarding Phishing, Credential harvesting and Social Engineering, across your business.  
  • Robust third-party onboarding checks – DPIAs, TPRAs. Set a high standard of information governance and data protection to understand what data you are sharing and whether you are confident that the supplier can keep this data secure. Whilst this won’t stop a breach from occurring, it’ll help reduce organisational risk and hold suppliers to account regarding their security posture and data processing standards.  

Looking for support?

So how exactly can th be done?

In light of the recent high-profile cyber attacks, it’s clear that robust cyber security measures are more critical than ever. At Stripe OLT, our Security Operations Center (SOC) operates 24/7 to ensure our clients are protected from these types of evolving threat.  

Using advanced threat intelligence and proactive threat hunting techniques, we block harmful content and intercept phishing attempts to safeguard our clients’ data. And crucially, our team continuously monitor identity assets to detect and respond to potential breaches as and when they happen.  

If this sounds like something you’d benefit from, get in touch with our team today. 


Our latest expert Intel

  • June 13, 2024
    Read full article
  • Obtaining actionable data from M365 Defender for Endpoint using KQL background
    May 29, 2024
    Read full article
  • May 29, 2024
    Read full article
  • May 29, 2024
    Read full article
  • Gootkit
    May 29, 2024
    Read full article
  • May 29, 2024
    Read full article
  • Malvertising
    May 29, 2024
    Read full article
  • Microsoft Ignite
    May 29, 2024
    Read full article
  • keys
    May 29, 2024
    Read full article
  • May 29, 2024
    Read full article
  • CVE-2023-42439
    May 29, 2024
    Read full article
  • password
    May 29, 2024
    Read full article