What does pharmacy cyber resilience look like after the NHS supplier attacks?

What did the NHS supplier attacks change?

They moved the boundary. In June 2024 a criminal group hit Synnovis, a pathology supplier to several major NHS trusts, with ransomware. The government's press release of 12 November 2025 counts "over 11,000 disrupted medical appointments and procedures" and cites estimates of £32.7 million in costs. The same release records that hackers reached the Ministry of Defence payroll in 2024 through a managed service provider. Neither victim was breached through its own front door. Both were breached through a company they paid to run something for them.

That is the pharmacy position exactly. A community pharmacy runs on a PMR it does not host, an EPS connection it does not operate, a website built by an agency, a wholesaler's ordering portal and a payments provider. Its own network may be a router and three terminals. The risk is concentrated in suppliers, and the government has responded accordingly. On 22 July 2025 it announced plans to ban public sector bodies, "including the NHS, local councils and schools", from paying ransoms. On 12 November 2025 it introduced the Cyber Security and Resilience (Network and Information Systems) Bill. The Bill would require regulated organisations to report incidents within "24 hours, with a full report within 72 hours". It would bring managed service providers under security duties and let regulators designate critical suppliers to essential services. The Bill was still before Parliament when its factsheets were last updated on 30 June 2026.

The background numbers show why. The Cyber Security Breaches Survey 2025/2026 was published on 30 April 2026, from fieldwork between August and December 2025. It found that 43 per cent of businesses identified a breach or attack in the previous year, rising to 46 per cent of small businesses. Phishing was experienced by 38 per cent of businesses. Only 25 per cent of businesses had a formal incident response plan, and 5 per cent held Cyber Essentials certification. A pharmacy is a small business holding health data for thousands of people, in a group that reported more attacks than average and less preparation.

What does the DSPT already require of a pharmacy?

More than most owners remember signing. The Data Security and Protection Toolkit is the annual self-assessment every NHS contractor with access to patient data completes, and Community Pharmacy England's page records the 2026 deadline as 30 June 2026. CPE's question-by-question guidance for 2026 turns each mandatory assertion into plain English. The table below lists the controls that matter most after a supplier incident, with the assertion numbers from that guidance.

Read as a list, that is a credible baseline. The problem is that each line is a declaration, and a declaration is only worth what sits behind it. "Backups routinely tested" means someone restored a file this year and wrote down the date. "Continuity plan tested" means the team ran the outage procedure, not that a document exists in a drawer. Our guide to completing the DSPT as a small pharmacy covers the submission; this article is about making the answers true.

How would you dispense if your PMR went down for a week?

Through the EPS Prescription Tracker, paper and a plan you have rehearsed. Community Pharmacy England's contingency guidance, updated on 21 July 2026, sets out the options when EPS prescriptions cannot be retrieved. You can ask the patient to return, deliver when systems resume, or make an emergency supply at the prescriber's request. You can arrange a paper FP10 from the GP or refer to another pharmacy. Since 31 July 2023 a business continuity plan for temporary suspension of service has been a Terms of Service requirement, and CPE's template covers disruption to IT services.

The tracker is the underused tool. CPE's page, updated on 25 March 2026, explains that "a business continuity mode has been added to the EPS prescription tracker". It is available "when the pharmacy has HSCN access but the IT system is down". Staff can keep checking outstanding EPS prescriptions and view the medicines on each item. That needs HSCN and a smartcard or CIS2 login on a machine that meets the Spine warranted environment specification. A pharmacy whose only HSCN device is the dead PMR terminal has no continuity mode. Check that today.

The week-long scenario is the one to plan for, because a supplier outage is not fixed by rebooting. Write down how labels are produced and how the controlled drug register is kept if it lives in the PMR. Record how owings are tracked and how every supply is written on paper for later entry. Our guide to running an electronic CD register covers the outage procedure the Misuse of Drugs Regulations expect. Then rehearse it. The NCSC's free Exercise in a Box offers tabletop exercises on ransomware and supply chain incidents. Its incident management guidance says exercises "can also highlight any problem areas in your planned response". An afternoon spent dispensing on paper with the system switched off will tell you more than any policy.

How do you manage the risk sitting inside your suppliers?

Know who they are, ask them the hard questions in writing and plan for their failure. The NCSC's supply chain security step tells organisations to keep "a list of all your suppliers, and partners, and identify which ones are highest priority". It asks for "a common understanding with your suppliers of each party's security responsibilities". Minimum requirements such as Cyber Essentials should be "proportionate to the risk for each supplier". Contracts should specify the return and deletion of your data on exit. The DSPT asks for the same list under assertion 10.1.2 and for certification under 10.2.1.

The NCSC's supplier assurance questions give you the script. Has the supplier suffered any material breach it needs to declare? Does it hold Cyber Essentials, Cyber Essentials Plus or ISO 27001? Do its users have the minimum access needed and no more? Would you want to be told if it changes subcontractors? What does the contract say about secure deletion or return of your data at exit? For a pharmacy the priority list is short: the PMR, the EPS and NHSmail connection, the website and consultation platform, the payments provider and the wholesaler portal. Ask each of them the questions in the checklist below and keep the answers with your DSPT evidence.

Clinical software carries a second layer of assurance. A PMR or consultation platform should be able to show its clinical safety case, and our guide to what buyers should ask about DCB0129 explains how to read one. A supplier that cannot answer the security questions is unlikely to answer the safety ones either.

What happens in the first 72 hours of a breach?

Contain, record, report and keep dispensing. The NCSC's incident management guidance warns against "over-reacting during the containment phase" before you have enough information. It expects a plan that names roles, links to business continuity, includes playbooks for specific incident types and covers "legal or regulatory reporting requirements". The DSPT guidance for pharmacies adds the fixed deadline. The ICO must be told "without delay and certainly no later than 72 hours", and affected individuals must be informed where the breach poses a high risk to a patient. The table below turns those requirements into a timeline for a single pharmacy.

Two points trip pharmacies up. First, a ransom demand is not a private matter. The government has said it intends to ban public bodies including the NHS from paying, and to require other organisations to notify it before they pay. Take advice before any conversation with an attacker. Second, an incident that affects patient care may also be a patient safety incident with its own reporting route, as our guide to reporting a patient safety incident explains. Keep the two logs separate but consistent.

Is cyber insurance worth it for a pharmacy?

Yes as recovery funding, no as a substitute for controls. The NCSC's cyber insurance guidance is blunt: "Cyber insurance will not instantly solve all of your cyber security issues, and it will not prevent a cyber breach". What a policy can do is pay for business interruption, third-party compensation claims, forensic investigation and legal and public relations help. It can also supply an incident response team you would otherwise have to find at 2am.

Read the exclusions. The NCSC notes that "some insurance policies will not cover monies lost through business email" compromise, which is one of the most common frauds a small business faces. Check the limits against a realistic week of lost dispensing income and the cost of rebuilding records. Expect the insurer to ask about your controls: the guidance says buying a policy "might require providing information about your security controls", and values Cyber Essentials. Your DSPT submission answers most of those questions, which is one more reason to make it accurate.

What does a resilient pharmacy look like in 2026?

It is a pharmacy that can lose any one supplier for a week and still supply medicines safely, prove what it did and tell the regulator on time. The NCSC's data security step gives the backup rule: at least three copies on two devices with one offsite. Backups should be kept "separate from your network, or in a cloud service designed for this purpose", retained for at least a month and tested before you need them. Its Cyber Essentials scheme sets five baseline controls: firewalls, secure configuration, security update management, user access control and malware protection, with certification from £320 plus VAT. Everything else in this article hangs off those two ideas.

Websites and consultation platforms deserve their own pass, because they are the part of the pharmacy the public can reach. Our guide to how secure a pharmacy website needs to be covers the controls an online service adds to this list.

Key takeaways

FAQs