State-sponsored cyber attacks targeting medical institutions working on treatments for coronavirus have been labelled “utterly reprehensible” by the UK’s cybersecurity agency.

On Tuesday, the UK’s National Cyber Security Centre (NCSC) and its US counterpart issued a joint advisory warning medical staff to improve their password security to protect themselves from hackers.

The two agencies said they have seen evidence of cybercriminals targeting healthcare bodies, particularly those involved in coronavirus response, which they believe is in the hope of gathering information related to the Covid-19 outbreak.

The advisory suggested that hackers were targeting medical research bodies “in order to steal sensitive research data and intellectual property for commercial and state benefit”.

The University of Oxford, which is one of the global leaders in research for a potential vaccine for Covid-19, confirmed it was taking advice from security experts on the issue.

“Oxford University is working closely with the National Cyber Security Centre to ensure our Covid-19 research has the best possible cybersecurity and protection,” a spokesman for the university said.

The NCSC and US Cybersecurity and Infrastructure Security Agency (CISA) urged medical and healthcare staff to change any passwords to one created using three random words, and to implement two-factor authentication on accounts to reduce the threat of compromises.

“Any attack against efforts to combat the coronavirus crisis is utterly reprehensible,” a spokesman for the NCSC said.

“We have seen an increased proportion of cyber attacks related to coronavirus and our experts work around the clock to help organisations targeted.

“However, the overall level of cyber attacks from both criminals and states against the UK has remained stable during the pandemic.”

In their advisory, the two security agencies said they have seen evidence of a number of “password spraying” attacks being used – where hackers attempt to access a large number of accounts using commonly known passwords – to target healthcare organisations and other medical groups.

At the daily coronavirus briefing on Tuesday, Foreign Secretary Dominic Raab said the Government was working with such organisations to “make sure that they’re aware of the cyber threat and that they can take the steps necessary to protect themselves”.

“We expect this kind of predatory, criminal behaviour to continue and to evolve over the coming weeks and months ahead, and we’ll be taking a range of measures to tackle that threat,” he said.