A ransomware cyber attack on Synnovis, a pathology services provider for the NHS in London, has been linked to the first confirmed patient death caused by delays in receiving blood test results. The June 2024 breach, attributed to the Russian-speaking cybercrime group Qilin, severely disrupted pathology services at major hospital trusts including King’s College Hospital, Guy’s and St Thomas’, and Lewisham and Greenwich hospitals, leading to widespread cancellations of thousands of surgeries and medical procedures.

King’s College Hospital Foundation Trust confirmed that one patient died unexpectedly during the period affected by the cyber attack. A detailed safety investigation identified multiple contributory factors surrounding the patient’s care, notably the delayed blood test results caused by the attack. The trust shared the findings with the patient’s family but withheld specifics about the individual’s identity or the date of death, citing confidentiality.

This ransomware attack, which infiltrated Synnovis’s systems by exploiting basic security flaws such as the lack of multi-factor authentication, encrypted critical data and rendered it inaccessible. The failure forced hospitals to revert to manual processes, as electronic transmission of test results was impossible. Staff had to rely on printed reports delivered by hospital porters, creating delays in diagnosis and treatment decisions that usually depend on swift blood test feedback. For a period of three months, vital procedures such as blood transfusions and blood matching were stalled, with hospitals forced to use universal blood types, depleting blood stocks and triggering a national appeal.

The South East London Integrated Care Board has identified 170 cases impacted by the attack, with most deemed to have caused low harm apart from the fatality. General Practitioners described the inability to access test results as “like flying blind,” illustrating the significant operational disruption faced by NHS and primary care services across six London boroughs.

The financial consequences for Synnovis have been severe, with losses estimated at £33 million, eclipsing the company’s previous annual profits. Synnovis is a public-private partnership, 51 percent owned by German pathology firm Synlab, with the remainder held by King’s College Hospital and Guy’s and St Thomas’. The company has stated it is working with IT security experts to bolster its defences and conduct rigorous testing. However, whether any ransom was paid to the hackers remains undisclosed due to “sensitivities.”

The attack has intensified calls from cybersecurity experts for an independent inquiry into NHS digital vulnerabilities and patient safety. Dr Saif Abed, a cybersecurity specialist, warned that the widely publicised death might be the tip of the iceberg, urging greater transparency and accountability for NHS cybersecurity standards, especially given the increasing role of external providers in delivering critical health services.

This incident highlights ongoing challenges in the NHS’s cyber resilience, particularly as it continues to face threats from sophisticated ransomware gangs operating beyond Western legal reach. Qilin, the Russian cybercrime group responsible, has been linked to multiple attacks on organisations worldwide and is known to lease its malware to affiliates, complicating efforts to identify and counter threat actors.

In response to the attack, the NHS and the Department of Health and Social Care have urged all health service suppliers to implement fundamental cybersecurity measures such as multi-factor authentication. Despite such appeals, the breach revealed persistent gaps in securing third-party providers, with potentially grave consequences for patient care.

At the frontline, staff have had to adapt to unprecedented operational pressures, managing prioritised testing for clinically critical cases only, while navigating delays and cancellations. A clinical staff member at Guy’s and St Thomas’ described how the manual handling of test results requires porters to physically transport printed reports to wards, a stark regression from usual digital workflows.

The fallout from the breach continues to reverberate across London’s health system as efforts are underway to restore full pathology services and evaluate the scope of harm caused. Investigations remain active by law enforcement and regulatory bodies, with potential financial penalties on the horizon for data protection breaches.

This grim episode underscores the urgent need for robust cybersecurity practices within the NHS, particularly in its reliance on outsourced diagnostic services, to safeguard patient safety and maintain trust in the digital infrastructure underpinning modern healthcare.

📌 Reference Map:

Source: Noah Wire Services