NHS England has confirmed that data from a ransomware attack on pathology services provider Synnovis has been published online by a cyber criminal group. The attack, which occurred on June 3 and is believed to have been carried out by the Russian group Qilin, has led to significant disruptions in medical services.
Synnovis experienced the cyber attack that has since resulted in the cancellation of hundreds of operations and appointments. NHS England, along with the National Cyber Security Centre and other partners, are working to determine the extent of the data breach and its implications.
In a statement released Friday, NHS England revealed that the cyber criminal group claimed to have published nearly 400GB of data, including sensitive information such as patient names, dates of birth, NHS numbers, and blood test descriptions. Financial arrangements between hospitals, GP services, and Synnovis were also reportedly shared on the group’s darknet site and Telegram channel.
Synnovis responded to the incident, expressing concern over the leaked data and stating that an analysis is already underway to verify the content’s origin and its relation to NHS patients.
The aftermath of the attack has been felt across medical facilities, with King’s College Hospital NHS Foundation Trust and Guy’s and St Thomas’ NHS Foundation Trust reporting over 1,100 planned operations and more than 2,100 outpatient appointments postponed. While the number of rescheduled operations has slightly improved since the first week after the attack, missed outpatient appointments have increased.
For any concerns or inquiries, NHS England encourages the public to reach out as they continue addressing this serious situation.
