National Crime Agency may take retaliatory measures after Qilin gang steals data covering 300m patient interactions