NHS Data Hacked: Tens of Thousands of Patients Exposed

In June 2024, a significant ransomware attack on Synnovis, a critical NHS third-party provider, led to the exposure of tens of thousands of patient data records. This breach, described as one of the most harmful cyber-attacks in the UK, affected trusts across Essex, Bedfordshire, and London, with Norfolk later revealed to be impacted as well.

The cyber-criminal group Qilin claimed responsibility, uploading approximately 400GB of sensitive Synnovis data to its darknet site. Initially, the group suggested a motive beyond financial gain, which experts dismissed as false. Synnovis confirmed data was "stolen in haste and in a random manner" from their hard drives, and they have been notifying affected organizations.

The attack caused immediate disruption, forcing King's College Hospital and Guy's and St Thomas' NHS Foundation Trusts to postpone over 1,300 outpatient appointments and 205 procedures. Crucially, one patient death at King's College Hospital has been officially linked to the incident due to a delay in receiving necessary blood test results.

While some trusts report no evidence of inappropriate data access, Synnovis stated that the risk to individuals is considered low. The National Cyber Security Centre has provided guidance for protection against data breaches. Medical data remains highly valuable on the dark web, making such attacks financially motivated, with criminals potentially using AI to enhance data value.