NHS Scotland-linked domains caught serving pr0n and dodgy sports streams
- Reference: 1775642414
- News link: https://www.theregister.co.uk/2026/04/08/scotland_nhs_domain_compromised/
- Source link:
First spotted by Nick Hatter, a former cybersecurity engineer turned psychotherapist and life coach, an influx of links hosted on a domain belonging to The New Surgery in Kilmacolm, near Glasgow, flooded Google's index in recent days.
On closer inspection, some seem to have been created as far back as January.
[1]
The landing page for the domain is not the one currently used by the practice, but it was likely used previously, given the [2]scot.nhs.uk namespace appears to belong to a US-based web developer as a guise for the illicit content it now hosts.
The New Surgery's current domain: [3]www.thenewsurgery.scot.nhs.uk
The domain hosting illicit links: [4]thenewsurgery-kilmacolm-langbank.scot.nhs.uk
The Register asked NHS Greater Glasgow and Clyde (NHSGGC), Scotland's largest health board and the one that oversees The New Surgery, to comment.
A spokesperson for NHSGGC said: "NHS Greater Glasgow and Clyde's cybersecurity team is working with Public Services Delivery Scotland's Cyber Centre of Excellence to support an independent GP practice after being made aware that a legacy website had been compromised. This affects a legacy website that was independently set up and managed by the GP practice, and there is no evidence the practice's primary website, or any NHS Scotland systems locally or nationally, were compromised."
[5]
[6]
We also contacted NHS National Services Scotland (NSS), which administers the [7]scot.nhs.uk domain.
In a statement, Scott Barnett, Chief Information Security Officer, Public Services Delivery Scotland, said: "Our NHS Scotland Cyber Centre of Excellence (CCoE) was made aware of a security issue affecting a legacy website associated with a local GP practice.
[8]
"At this time, we are not aware of personal or sensitive data exposure as a result of this incident. There is also no evidence the practice's primary website, or any NHS Scotland systems locally or nationally, were compromised.
"Our CCoE teams are continuing to work closely with NHS Greater Glasgow and Clyde's cyber security team to understand the cause of the issue and to ensure it has been fully contained."
Hatter also told The Register that after unearthing the initial compromise related to The New Surgery, he found similar activity at the domain for Lerwick GP Practice, located in the remote Shetland Isles.
[9]
In Lerwick's case, the domain currently in use by the practice is the one serving the illicit links. The New Surgery's compromised domain has not been used for the practice's primary website in years.
A search using the Wayback Machine shows that [10]as of 2019 , one of the sites now serving dodgy links was indeed the one used to access The New Surgery, suggesting it was compromised at some point more recently.
In discussions related to the original The New Surgery findings, Alan Woodward, professor of cybersecurity at the University of Surrey, told The Register : "The big question is, is it a real surgery or is someone putting up a dodgy URL to automatically redirect?
"Either way, the scot.nhs.uk subdomains are managed by NHS Scotland, so somehow someone has managed to set up a subdomain of scot.nhs.uk, which should be under NHS Scotland's control.
[11]NHS staff resist using Palantir software
[12]NHS tech supplier probes cyberattack on internal systems
[13]Barts Health seeks High Court block after Clop pillages NHS trust data
[14]Clop claims it hacked 'the NHS.' Which bit? Your guess is as good as theirs
"The most obvious way I can think someone would have done that is to steal credentials of a system admin, access the DNS controller, and add in the redirect from a URL that looks like it could be a particular GP surgery but actually isn't. That suggests a deeper penetration than just one surgery being hacked. It also means that the usual users of that GP's website won't have noticed anything, so how long it's been there, who knows."
Because the [15]nhs.uk and [16]scot.nhs.uk domains are closed, an everyday cybercrook cannot simply register a copycat of a GP practice within these namespaces and begin hosting questionable content.
Registering a website using these namespaces requires official authorization through the NHS directly, so the question for [17]NHS Scotland is how a domain under its control was apparently compromised.
The same applies to DNS record changes, and NHS domains are also eligible for protection under the [18]UK NCSC's Protective DNS scheme , although each public sector organization must apply for it, rather than it being applied automatically.
Hatter told The Register : "My guess is this could be a DNS attack of some sort or a compromised WordPress setup, which is more likely."
Domain Information Groper (dig) queries show that the NHS domains are correctly and safely pointing to WP Engine, suggesting the compromise was on the WordPress side.
Hypothetically, if the hijackings were caused by exploitation of a plugin vulnerability, for example, it would [19]hardly be the first time something like this had transpired as a result.
"In my opinion, it is quite possible other NHS Scotland practices are vulnerable to this attack," Hatter added. ®
Get our [20]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2adZ7rD5UylgUO2PpN5n55QAAAEQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] http://scot.nhs.uk
[3] http://www.thenewsurgery.scot.nhs.uk
[4] http://thenewsurgery-kilmacolm-langbank.scot.nhs.uk
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44adZ7rD5UylgUO2PpN5n55QAAAEQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33adZ7rD5UylgUO2PpN5n55QAAAEQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] http://scot.nhs.uk
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44adZ7rD5UylgUO2PpN5n55QAAAEQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33adZ7rD5UylgUO2PpN5n55QAAAEQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://web.archive.org/web/20190201194127/https://www.thenewsurgery-kilmacolm-langbank.scot.nhs.uk/surgery-information/
[11] https://www.theregister.com/2026/04/03/nhs_staff_against_palantir/
[12] https://www.theregister.com/2025/12/18/nhs_tech_supplier_cyberattack/
[13] https://www.theregister.com/2025/12/08/barts_health_clop_block/
[14] https://www.theregister.com/2025/11/14/nhs_clop/
[15] http://nhs.uk
[16] http://scot.nhs.uk
[17] https://www.theregister.com/2024/03/28/nhs_scotland_cyberattack/
[18] https://www.theregister.com/2024/08/02/uk_ncscs_plans_to_revamp/
[19] https://www.theregister.com/2025/12/01/uk_budget_leak_blamed_on/
[20] https://whitepapers.theregister.com/
FFS.... basics
I've seen WordPress compromised repeatedly.
The moment you hand a CMS to a non technical team, there will be issues.
The maintenance and upkeep is ignored as let's be honest, how much change will a surgery operating under an NHS domain really need?
Do they really need something like Wordpress to tell the octogenarians that don't use the website how to get their prescriptions this week?
Business needs and an impact analysis would help.
I'm all for citizen developers, but once they've mastered security (never going to happen) then give them the keys to the kingdom, or give them a much more secure and watered down access to WP. i.e here's how you update the one page you'll need to tweak.
Re: FFS.... basics
Correct. Couple of pages of static HTML - job done.
Re: FFS.... basics
Our work site was compromised about two years ago. I said I could resolve but it would require overtime but there is no one around to authorise it and you've told us we can't take it unless authorised "OK, well is it important? Can it wait till tomorrow so you can do it during the day?"
FFS!! The site was server a bent shop content and likely stealing credit card info, but yeah, lets wait till tomorrow then.
Cockends.
All because the person admining it was the useless PR pod. She had no tech experience and turns out used an independent web dev who was overcharging her. I asked him it was clear this happened because none of the wordpress plugins had been updated and the exploited one. PR pod had left by this point and he said "She made me leave it that way. She said she didn't like the updates so just leave all the plugins out of date so it all looks the same when I need to update the pages".
Re: FFS.... basics
Agency I had been with for a few years had a Wordpress site, that I'd randomly do really basic pentests on out of curiosity between tickets. Until one day I discovered one of their pages was compromised. I told the owner. A year later it was still the fucking same.
But then this is the same agency that kept breaching GDPR by copying all their contractors in on e-mails without hiding their address'. I found two of the people in the list and contacted one who said she'd left them a year before yet they still kept e-mailing her. I then found out where another was temping and could have spoofed the agency to e-mail him to get bank details. I warned them about this. Every time they did this, they brushed it off as "lessons learned". Then would do it again a few months later.
The worst incident is when they sent my payslip to another engineer where we were both working!
Really, I should have reported them to the ICO but needed the work.
Re: FFS.... basics
I think you meant to say as soon as you shove web content into a CMS, there will be issues. Especially when Wordpress is the back end.
Part of the problem with WP is it lets clueless fuckwits (aka marketing, bizdev, sales, HR, etc) delude themselves they can create web sites and never have to think about basics like maintenance, testing, security, change control, etc. After all, it's only a web site - isn't it?
I've had this happen to me when I've had a subdomain pointing to a cloud server. If you delete the server, but don't delete the DNS record, the IP address will get reused by your cloud provider and the new customer can serve what they like on your subdomain.
There's a very reasonable chance that if a small org like a surgery creates a new website, they will switch to a nicer domain at the same time. Ideally they'd have the old domain re-pointed to the new server and set up to redirect forever, or at least remove it from DNS. In this case the DNS is managed by a separate org however, and it may be a bit more difficult to get a change made than it would be with a normal registrar, and I can easily see the cleanup getting missed.
Given that this probably happens fairly often, I'm sure there are likely to be malware scum constantly creating new resources with most cloud providers, hoping to be allocated a nice IP address with a juicy DNS allocated to it. No fiddly system compromises required, just taking advantage of what's lying around.
"Oh we don't need to worry about that domain, we don't use it anymore"
FFS. Anon for obv reason
I came here to say that it's more likely a forgotten DNS entry than actual compromise. It seems odd that the Register's correspondent jumped to the conclusion that someone had broken into the DNS controller and used that to create a URL redirect (how do you even do that when DNS has no influence on URLs)
NHSGG&C IT department is toxic, I used to work there.
P.S. That's the wrong logo
wrong domain?
Doesn't NHS in Scotland use .nhs.scot domain in preference to the .scot.nhs.uk, not wishing to be associated with those from south of the border...
Ho Hum
I never get to see any of this stuff...
Dunno whether to be annoyed or relieved