Ransomware attack on payroll supplier leaves 40,000 NHS staff facing late or wrong pay

About 40,000 NHS workers at three hospital trusts in the north-west of England have been warned they may be paid late or incorrectly this month after a ransomware attack shut down the payroll company that processes their wages.

Pennant Systems, a Warrington-based firm that runs payroll and rostering for 11 NHS organisations and about 60 councils and housing associations, discovered on the morning of 6 October that its servers had been encrypted. A criminal group calling itself Vortex has claimed responsibility on a dark-web site and is demanding about £6m in cryptocurrency. It says it has copied 1.4 terabytes of data including names, national insurance numbers and bank details.

The three trusts most affected, which together run hospitals in Manchester, Bolton and Lancashire, said on Monday that they were paying staff on the basis of September’s figures, with adjustments for overtime and bank shifts to follow. Agency workers and those who changed role, hours or bank account in the past month are most likely to be affected. The trusts have set up hardship funds offering advances of up to £1,500.

“We will make sure that nobody is out of pocket, but I cannot promise everybody will be paid the right amount on the right day,” said the chief executive of one of the trusts in a message to staff seen by the Daily Meridian. “Please check your pay slip carefully and tell us if it is wrong.”

The National Cyber Security Centre said it was working with the company and had no evidence that clinical systems were affected. The Information Commissioner’s Office has been notified. Pennant said it had not paid and would not pay the ransom, and that it was restoring systems from backups held offline, a process it expected to take “several weeks”.

The attack is the latest in a pattern of criminal groups targeting the small suppliers on which public services depend rather than the services themselves. A pathology supplier to London hospitals was crippled in 2024, and a social care software firm in Scotland in 2025. The NHS’s own cyber security standards do not extend to third parties beyond a requirement that contracts include “appropriate assurance”.

“Every one of these companies is a single point of failure for a dozen organisations, and most of them have a security team you could fit in a taxi,” said Dr Aisling Conroy, a lecturer in cyber security at Lancaster University. “The trusts did their due diligence, the supplier had a certificate on the wall, and none of it mattered.”

Unison, which represents about 15,000 of the affected staff, said it had received more than 600 calls to its helpline since Friday. A porter at Royal Bolton hospital, who asked not to be named, said he had been told his overtime for a 68-hour fortnight would be paid “at some point”. “My mortgage does not come out at some point,” he said. “It comes out on the 15th.”