Forensic labs attacked by hackers hold evidence in 30 Scots cases

Potentially crucial evidence in dozens of Scottish cases is held at an English firm hit by hackers, we can reveal.

Leading lawyers said the impact on the cases could be “potentially catastrophic” as a major investigation was launched after Eurofins Scientifics, running Britain’s biggest private forensic labs, was targeted in the so-called ransomware incident.

It’s understood material relating to 30 Scottish cases was being assessed by Eurofins at labs in England.

The work was outsourced by the Scottish Police Authority, who manage forensic science services on behalf of Police Scotland.

The SPA said they hoped to retrieve material relating to some of the cases to process it at their own labs in Scotland.

However, some cases could face delays while the impact of the attack is fully assessed.

Police forces across the UK have taken emergency action and suspended sending forensics work to the company while an investigation is conducted.

The SPA said forensic work was outsourced to Eurofins amid a heavy workload and increasingly complex cases.

They are now assessing the impact the attack may have had on possible evidence.

Ransomware is malicious software that prevents users from accessing their system or personal files and sometimes involves threats to publish or destroy data. The criminals demand ransom to restore access.

Judges and prosecutors have been alerted to the attack amid fears that evidence could have been manipulated in the incident.

Eurofins Scientific has laboratories around the world with UK testing centres in Middlesex, Cambridgeshire, Oxfordshire, Derbyshire and Yorkshire.

The company said in a statement that it was targeted by the ransomware attack over the weekend of June 1 and 2.

The attack affected the IT systems of the company’s forensics subsidiary, which is based in the UK and is one of the main forensic service providers to UK policing.

Police chiefs put an emergency plan of action in place on June 3 when they suspended submissions to the company.

It is understood that less serious and historical cases may face delays.

Eurofins processes 70,000 cases a year for police and law enforcement.

Mr Findlay said yesterday: “I would regard this as a very serious matter. If there is any question that forensic material may have been interfered with in any way then that would be very alarming indeed. That this could happen is bad enough but the possible impact on those accused of crime and the alleged victims of crimes is potentially catastrophic.”

Brian McConnachie QC, one of Scotland’s most experienced criminal defence lawyers, said: “If there is any prospect someone has interfered with a private company’s computer systems and could in any way interfere with forensic evidence then that could have disastrous consequences.”

The Scottish Police Authority said: “Due to the increasing complexity of biology cases being received in recent years, SPA Forensic Services put in place initiatives to address their workload including outsourcing a small percentage of biology cases.

“Eurofins and another provider were awarded a joint contract and began processing biology cases on our behalf in September 2018.

“We are working closely with Eurofins to understand what impact this cyberattack may have on the handful of outstanding cases still being processed by the company.”

The National Crime Agency is leading the investigation into the hacking.

NCA director Rob Jones said: “We are securing evidence and forensically analysing infected computers. But due to the quantity of data involved and the complexity of these kinds of enquiries, this investigation will take time.”

Forensic science and DNA evidence have led to a number of high-profile convictions in unsolved cases.

Last month, a Glasgow takeaway owner who strangled a young woman to death more than two decades ago was jailed after being snared by his DNA.

Zhi Min Chen, 44, killed Tracy Wylde in November 1997 but evaded capture until he was held for an alleged assault 16 years later, when police matched his DNA with DNA found at the scene at the time.

He was jailed for 20 years.