NHS Scotland Domain Breached to Host Adult Content and Illegal Sports Streams, Exposing Infrastructure Vulnerabilities
Published
Key Takeaways
- Legacy systems exploited: Cybercriminals breached NHS Scotland domains, targeting vulnerable web infrastructure to redirect traffic to unauthorized external servers.
- Illicit content hosting: Threat actors aggressively repurposed these compromised healthcare domains for illicit content hosting, serving adult material and illegal sports broadcasts.
- Impact: The unauthorized domain manipulation involved The New Surgery in Kilmacolm and the Lerwick GP Practice.
Several NHS domains of localized medical practices were compromised. Threat actors successfully hijacked subdomains linked to the National Health Service to push links to adult content and illegal sports streams, recent threat intelligence reveals.
The attacks compromised legacy web infrastructure tied to The New Surgery in Kilmacolm, as well as the active domain of the Lerwick GP Practice, as per Public Services Delivery Scotland CISO Scott Barnett.
Investigating the Compromised Healthcare Domains
Former cybersecurity engineer Nick Hatter identified multiple instances of unauthorized access affecting regional medical facilities that were recently indexed by Google, some dating back as far as January.
The NHS breach involved the “nhs.uk” and “scot.nhs.uk” closed domains. Visitors navigating to these addresses encountered adult entertainment and illegal streaming services rather than legitimate medical information.
NHS Greater Glasgow and Clyde, alongside the Public Services Delivery Scotland Cyber Center of Excellence, rapidly initiated containment protocols. External-facing web properties suffered defacement and redirection, but core patient databases and national clinical systems remain completely secure, a spokesperson for NHSGGC has told The Register.
Unknown Tactic
Hatter assessed that the NHS Scotland hijacking likely stemmed from a DNS attack or a compromised WordPress setup, rather than a direct breach of top-level NHS routing infrastructure.
“The ‘scot.nhs.uk’ subdomains are managed by NHS Scotland, so somehow someone has managed to set up a subdomain of ‘scot.nhs.uk,’ which should be under NHS Scotland's control,” he added.
In February 2026, the malicious Outlook Add-in AgreeToSteal compromised 4,000 accounts via subdomain takeover.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular