By Joe Tidy, Cyber reporter
& Tom Gerken, Technology team
A cyber-attack on a major IT provider of the NHS has been confirmed as a ransomware attack.
Advanced, which provides digital services like patient check-in and NHS 111, says it may take three to four weeks to fully recover.
Ransomware hackers take control of IT systems, steal data and demand a payment from victims to recover.
The NHS insists that disruption is minimal, but Advanced would not say whether NHS data had been stolen.
The Birmingham-based firm says it first spotted the hack at 07:00 BST on 4 August and immediately took steps to contain the hackers. It is now working to restore services.
The company refused to say if it was in negotiations with hackers or paying a ransom to them.
In a statement, it said: "We are rebuilding and restoring impacted systems in a separate and secure environment."
This video can not be played
Watch: What is ransomware and how does it work?
An NHS England spokesperson said: "While Advanced has confirmed that the incident impacting their software is ransomware, the NHS has tried and tested contingency plans in place including robust defences to protect our own networks, as we work with the National Cyber Security Centre to fully understand the impact.
"The public should continue to use NHS services as normal, including NHS 111 for those who are unwell, although some people will face longer waits than usual.
"As ever, if it is an emergency, please call 999."
An NHS psychiatrist, who wished to remain anonymous, told the BBC the attack left his team "making clinical decisions nearly blind".
"If a new patient came to us, we weren't able to read their history or know very much about them," he said.
"The [local] trust are doing their best at setting up an alternative system, they've got a way that we can look at some historical notes now, and have set up another system to mean that we can input new notes.
"But there's still basically a week's worth of notes that we can't access. We've been told to be ready for it to not be up and running for who knows how long."
At the end of last week, family doctors in London were warned by NHS England they could see an increased number of patients sent to them by NHS 111 because of the "significant technical issue", industry magazine Pulse reported.
Advanced initially said that only a "small number of servers" had been affected and that it might be able to recover in a week.
Products which have been affected include Adastra, which is used by NHS 111 service, and Caresys and Carenotes, which provide the backbone for care home services like patient notes and visitor booking.
The National Cyber Security Centre, which is part of GCHQ, says it is working with Advanced to help it recover.
A spokesman said: "Ransomware is the key cyber-threat facing the UK, and all organisations should take immediate steps to limit risk by following our advice on how to put in place robust defences to protect their networks."
Ransomware hackers are usually financially motivated and part of large, professionally run criminal gangs that target companies and demand hundreds of thousands, sometimes millions, of pounds in ransom in the form of cryptocurrencies like Bitcoin.
While it is hard to trace where the gangs are based, analysis suggests that 74% of all money made through ransomware attacks in 2021 went to Russia-linked hackers.
NHS 111 software outage confirmed as cyber-attack
NHS ransomware attack response criticised
NHS ransomware attack's bitcoins moved
FBI took top secret documents from Trump's home
Rushdie on ventilator and unable to speak – agent
Gunman kills 11 after family dispute in Montenegro
We fled the Taliban for our Olympic dream. Video
Ibiza: The birth of the 'party island' Video
Meet the Indians named after historic events
Predicting Russia's next step in Ukraine
The mystery deaths of two Saudi sisters in Sydney
Salman Rushdie: The writer who emerged from hiding
'I'm a different person after having monkeypox'
The world's first long-distance car journey
The librarian who defied the Taliban
The best public pools around the world
Why open relationships are on the rise
The ejector seats that fire through the floor
© 2022 BBC. The BBC is not responsible for the content of external sites. Read about our approach to external linking.
By Joe Tidy, Cyber reporter