NHS England Confirms Patient Data Stolen in Cyber Attack

The core point: healthcare cyberattacks are patient-safety events

The Synnovis ransomware incident was not just an information-technology story. Synnovis provides pathology services to NHS organisations, and the reported disruption affected blood testing, transfusion-related work, hospital operations, GP services and patient communication.

That matters because healthcare data is operational as well as personal. It is used to diagnose, treat, schedule, prioritise and reassure. When attackers encrypt systems, threaten publication or remove access to critical pathology infrastructure, the risk moves beyond confidentiality into continuity of care.

The public-confidence question is therefore wider than “was data leaked?”. It is whether the NHS, its suppliers and regulators can show that systems are secure, recoverable, accountable and capable of communicating clearly with affected patients.

The incident: ransomware, pathology systems and reported data publication

On 3 June 2024, Synnovis was reported to have suffered a ransomware attack affecting pathology services used by major London NHS trusts and GP services. Public reporting identified the Qilin ransomware group as the group believed or reported to be responsible.

The attack was reported to have disrupted Synnovis systems and affected NHS services that depended on pathology results. Later reporting stated that files claimed to have been stolen from Synnovis were published online, with several reports describing the published material as close to 400GB. The contents and full implications were matters for investigation.

Patient data risk: why this breach was so sensitive

The reported data categories included names, dates of birth, NHS numbers and descriptions of blood tests. Some reporting also referred to business or financial spreadsheets connected to NHS service arrangements. Public reports differed on the level of certainty about test results and the full content of the published files.

For publication, the safe point is this: healthcare data is special because it can be intimate, identifying and operationally important. Even where the full contents are still being verified, the possibility that patient identifiers and test-related descriptions were exposed creates a serious privacy and fraud-risk concern.

Service impact: disruption is part of the harm

The immediate public focus was understandably on stolen data. But in healthcare, the loss of system availability can be just as serious. Blood testing and pathology services support operations, emergency care, cancer pathways, transplant work, GP decision-making and routine monitoring.

Public reporting described thousands of postponed appointments and procedures. The exact numbers changed as the incident developed. The broader point is that a ransomware incident affecting clinical infrastructure can produce practical harm even before the long-term privacy consequences are fully understood.

Data security duties: confidentiality, integrity and availability

The UK GDPR security principle is not limited to keeping information secret. It concerns appropriate security of personal data, including protection against unauthorised or unlawful processing and accidental loss, destruction or damage.

For healthcare systems, that duty has practical force. Organisations need measures that protect confidentiality, integrity and availability; they also need the ability to restore access to personal data in a timely way after a physical or technical incident.

That does not mean a ransomware attack automatically proves legal failure. It means a root-cause analysis is essential: what risks were known, what controls existed, what failed, what was tested, and whether the technical and organisational measures were appropriate to the sensitivity and operational importance of the data.

Breach response: communicate early, update clearly

The ICO’s breach-reporting guidance recognises that complex incidents may not be fully understood immediately. But it also emphasises the need to report early, update later, and provide accurate information as soon as possible.

For patients, the practical need is simple. They need to know whether appointments continue, whether urgent care remains available, whether their data may be affected, what support route exists, and what suspicious contacts should be treated as potential scams.

The resilience test: what the public should expect next

Cybersecurity cannot be judged only by whether an organisation was attacked. Large public-service systems will be targeted. The stronger question is whether the organisation was prepared, whether controls were proportionate, whether recovery plans worked, and whether patients received clear communication.

Healthcare organisations and suppliers should treat the Synnovis incident as a resilience test. That means looking beyond passwords and firewalls into contracts, supplier oversight, backups, manual fallback, incident command, patient communications, procurement, clinical prioritisation and board-level accountability.