Email (IT)

Read more: NHS.net Connect.

Phishing is a type of cyber-attack where someone sends a fake email to trick the recipient into:

• Giving away sensitive information, or
• Clicking a link or opening an attachment that installs harmful software.

Phishing attacks have become more advanced in recent years.

For training and guidance, see: Data security training and National Cyber Security Centre guidance.

There have been a recent increase in scam emails being sent to community pharmacies.

Some of these messages falsely claim that the pharmacy is under investigation for a data protection or GDPR compliance breach.

These emails can appear convincing at first glance. However, they often feature significant warning signs and should be deleted without responding.

Typical features of the scam

• May be sent from free webmail accounts, such as Gmail, rather than official domains used by the NHS, the Information Commissioner’s Office
• Claims that the pharmacy is subject to a mandatory GDPR investigation
• Threats of urgent deadlines or potential enforcement action

Key reassurance for pharmacy teams

The ICO does not initiate regulatory action through unsolicited emails sent to general inboxes.

NHS England and the DHSC would never direct pharmacies to respond to a private company regarding a GDPR investigation.

Data security guidance including on DPOs can be found on our data security pages and within our Data Security and Protection Toolkit (DSPTK) guidance.

What pharmacies should do

• Do not open any attachments.
• Do not click links.
• Mark it as spam and/or delete
• Report suspicious messages to report@phishing.gov.uk.
• If the message arrived via an @nhs.net inbox, use the NHSmail phishing‑reporting function.

An email mailing list is a group of names and email addresses used to send messages to multiple people at once.

Organisations using mailing lists should follow proper procedures and comply with data protection laws.

Top tips:

• Check your spam folder occasionally—but be cautious of phishing emails that may appear there.
• Ask your email provider to flag external emails to help spot messages pretending to be from colleagues.
• Use an out-of-office message if no one will be available to reply to emails.

Local Pharmaceutical Committees (LPCs) can choose their own email providers. LPCs may also keep mailing lists of pharmacy owners, which often include NHS.net Connect and other email addresses.

There’s no national system for LPCs to automatically receive NHS.net Connect accounts.

Pharmacy owners using NHS.net Connect must complete the Data Security and Protection Toolkit (DSPTK) during each reporting period.

NHS.net Connect doesn’t offer an automatic way to contact pharmacy owners within an LPC area. LPC members who also work in community pharmacies may have NHS.net Connect accounts through their pharmacy role.