Britain’s National Cyber Security Centre (NCSC) has dealt with 194 coronavirus-related incidents involving hostile states and criminal gangs, which led to the overall number of serious hacker attacks reaching an all time record of 723 over the past year. The intelligence unit said that while Russia and other states – such as China – had targeted British vaccine research, it was criminal gangs who frequently targeted other parts of the NHS, often to attempt online fraud. A frequent method of attack used by both groups was spear phishing, creating plausible emails targeted at key individuals designed to encourage them to click on a link to malware or to obtain more information by deception. “Nation state actors are using Covid as a theme, sending what appear to be news articles from popular media outlets in an attempt to encourage targets to click on what are dangerous links,” warned Paul Chichester, director of operations. The NCSC official said that British researchers were targeted “by a range of nation states” although he would only cite Russia by name. The country was previously accused in the summer of trying to steal vaccine secrets. Hackers connected to Beijing are widely believed to be involved in trying to take the work of western scientists, although Chichester said “the ultimate decision to call a country out rests with the Foreign Office” and that “we have made a conscious decision to call out the Russian attacks”. Criminal groups meanwhile posed as PPE suppliers, offering to supply equipment to NHS organisations in the hope of persuading a busy purchaser to hand over money to a company that did not exist, NCSC officials added. A newly created service where anybody could report a suspicious email to NCSC at report@phishing.gov.uk was inundated with 2.3m emails, which led, the agency said, to 22,000 internet sites being taken offline. The pandemic threat also meant that the NCSC found itself engaged with unexpected businesses, including the supermarkets, whose supply chain systems were identified as part of the UK’s critical national infrastructure when the crisis first emerged in the spring. Taken together the extra threat posed by state and criminal hackers meant that NCSC dealt with 10% more incidents in the year to 31 August, a total of 723, the highest level since the organisation was first formed in 2016. There were around 1,200 victims, up by a third, reflecting the fact that the most serious attacks targeted multiple actors. “The second half of the year was massively dominated by Covid,” said Lindy Cameron, NCSC’s chief executive. Both public and private sector organisations can call in NCSC to deal with a serious cyber-attack, and in a crisis a squad of cyber-experts can be deployed alongside the company or unit’s IT department to tackle the threat. Ransomware incidents – where a hacker disables an IT system or steals sensitive data and demands a payment for restoring or returning it - rose threefold in the past year, and the tactics of criminals have also changed. “Rather than simply preventing access to data, criminals are stealing it and threatening to leak the most sensitive parts publicly,” NCSC’s annual report said, echoing “hack and leak” attacks used by Russian actors to influence the 2016 US election with the targeting of Democratic party emails. Targets during the past year included an unnamed “English football league club” which suffered a “crippling attack” on its corporate and security systems, which prevented its CCTV and turnstiles from working and almost led to a fixture being called off at short notice.