Mental health charity hit by ‘devastating’ ransomware attack 

A prominent Scottish mental health charity has been hit by a ‘devastating’ ransomware attack – crippling its systems and communications channels.

SAMH – the Scottish Association for Mental Health – has revealed that it has come under a ‘sophisticated and criminal’ cyberattack which is disrupting its services.

Police have been called in to assist the organisation, which provides mental health services across the country, as hackers posted a 12.5 gigabyte cache of its stolen data on the dark web.

Billy Watson, chief executive at SAMH said: “We are devastated by this attack. It is difficult to understand why anyone would deliberately try to disrupt the work of an organisation that is relied on by people at their most vulnerable.  

“Our priority is to continue to do everything we can to deliver our vital services. My thanks to our staff team who, under difficult circumstances, are finding ways to keep our support services running to ensure those they support experience as little disruption as possible. 

“We are working closely with various agencies including Police Scotland – this is an active investigation.   

“We will continue to take the best expert advice to assist us in effectively dealing with this situation.”

The ransomware attack was carried out by a cybercrime gang called RansomExx, a Trojan-based strain that uses email as its delivery method.

Some of the gang’s victims include low-cost Colombian airline Viva Air, German logistics company Hellmann Worldwide and Caribbean mobile phone network Digicel. In the UK, the gang targeted ForHousing and Liberty, a housing association group based in Salford, Manchester, last year.

SAMH is the latest in a growing list of Scottish organisations to be affected by ransomware, which include the Scottish Environment Protection Agency (SEPA), Glasgow housing charity Aspire and industrial giant the Weir Group.

A Police Scotland spokesperson said: “We received report of a cyber incident at a charity in the Glasgow area, which occurred on Thursday, 17 March, 2022. 

“Enquires are at an early stage and we are providing support to those affected.”