Police have halted all work with the UK’s largest private forensics provider after a ransomware attack, in the latest crisis to hit the forensics sector.
Eurofins, which carries out DNA analysis, toxicology, ballistics and computer forensics work, detected a breach of its system on 2 June. It has emerged that police have suspended all work with the company, thought to amount to more than 50% of outsourced case work.
Every police force in the country has had a cap placed on the volume of forensic work they can carry out and a police Gold Group response has been mounted – a step only taken in the case of major incidents or emergencies – to manage the increasing backlog. Cases are expected to be delayed as a result.
In a statement, the National Police Chiefs’ Council lead for forensics, Chief Constable James Vaughan, said: “We have put our national contingency plans in place, which will see urgent submissions and priority work diverted to alternative suppliers to be dealt with as quickly as possible.
“It is too early to fully quantify the impact, but we are working at pace with partners to understand and mitigate the risks. We will share more information as soon as we can.”
An NPCC police spokesman said that all work with Eurofins was suspended on 3 June, when they learned of the ransomware attack. The company has been told to return any casework that had not been started.
For the past two weeks, regional police forces have been required to submit all requests for forensic work to a national emergency team, which is managing outsourcing on behalf of the whole system to prioritise the most serious cases.
The company processes more than 70,000 cases each year, including murders and terrorism offences. Other private providers do not have the capacity to take on all this extra casework, which could mean significant delays in forensic testing and court cases.
The forensic sector has been hit by a series of problems recently, including the collapse of Key Forensic Services and the continuing criminal investigation into alleged drug test manipulation at the Randox Testing Services laboratory in Manchester.
The NPCC said it was unclear how long it would be before Eurofins could give assurances that its systems were safe or whether any forensic data held by the company had been affected or accessed by the perpetrators of the cyber-attack.
Ransomware is a type of computer program that infiltrates an IT system and threatens to publish the victim’s data or block their access to it by encrypting files.
Eurofins said prompt action had been taken to contain the incident and that it had not so far found any evidence that confidential client data had been stolen or transferred.
“Information from law enforcement and independent cybersecurity experts lead us to believe that this attack has been carried out by highly sophisticated, well-resourced perpetrators,” the company said.
Rob Jones, the director of threat leadership at the National Crime Agency, which is leading the criminal investigation into the cyber-attack, said: “Specialist cybercrime officers from the NCA are working with partners from the National Cyber Security Centre and the National Police Chiefs’ Council to mitigate the risks and assess the nature of this incident.
“We are securing evidence and forensically analysing infected computers, but due to the quantity of data involved and the complexity of these kinds of inquiries, this is an investigation which will take time; therefore we cannot comment further.”
