Synnovis ransomware attack disrupts pathology services at London NHS hospitals

Synnovis, the pathology partnership formed by Guy's and St Thomas' NHS Foundation Trust, King's College Hospital NHS Foundation Trust and the laboratory group Synlab, was hit by a ransomware attack on Monday 3 June 2024. The Qilin extortion group was identified as the likely perpetrator.

Because blood testing, transfusion matching and diagnostics run through Synnovis, the disruption spread across hospitals and primary care services in six south east London boroughs: Bexley, Bromley, Greenwich, Lambeth, Lewisham and Southwark. NHS England also listed South London and Maudsley, Lewisham and Greenwich, Oxleas and Bromley Healthcare among the affected organisations. Pathology capacity at the two main trusts fell to roughly a tenth of normal in the first week.

NHS England reported that between 3 and 9 June the two trusts postponed 814 elective procedures, 97 of them cancer treatments, together with 736 hospital outpatient appointments and 125 community appointments. Hospitals could not match patients' blood at the usual rate, prompting NHS Blood and Transplant to appeal publicly for O positive and O negative donors.

Emergency and urgent care stayed open, and NHS organisations told patients to attend booked appointments unless contacted directly. Officials warned in mid-June that full technical restoration would take time and that rebooking cancelled tests would prolong disruption for months. Synnovis did not pay, and on 20 June Qilin published around 400GB of stolen data on its leak site.