NHS Appointments, A&E and Tests During an IT Outage

When an NHS cyber attack makes the news, the first question most households have is a simple one: is my appointment still on? The answer, based on how past attacks have actually played out, is that most care continues. During the WannaCry attack of May 2017, the largest cyber attack to affect the NHS in England, 1.2 per cent of first appointments, 6,912 in total, were cancelled and rearranged between 12 and 18 May¹. During the Synnovis ransomware attack in June 2024, all urgent and emergency services such as A&E, urgent care centres and maternity departments remained open as usual².

So the working rule is this: attend your appointment, operation or test unless you are contacted and told otherwise. Hospitals and GP practices contact patients directly when something is cancelled, and unaffected hospitals create capacity to take patients from those that are disrupted². If you are unsure, call the number on your appointment letter, use the NHS App to book and manage appointments², or call NHS 111, which is available 24 hours a day, seven days a week³.

This page explains what happened to appointments, A&E and blood tests in the real NHS cyber attacks, how long the disruption lasted, and what to do about the scam calls and texts that tend to follow any data breach. For the wider picture of how a major incident is handled, see our guide to how the NHS, government and regulators respond.

Most appointments go ahead unless you are told otherwise

The clearest evidence for this comes from WannaCry, the ransomware attack that hit the NHS in England on 12 May 2017. It affected at least 80 out of 236 hospital trusts across England, and 595 out of 7,454 GP practices, 8 per cent, were infected¹. Yet the effect on planned care was small relative to the NHS's normal workload. The NHS cares for over 1 million patients every 24 hours, and in total 1 per cent of NHS activity was directly affected by the attack¹.

Of the appointments that were disrupted, NHS England identified 6,912 first appointments as cancelled and rearranged between 12 and 18 May, which was 1.2 per cent of the total¹. NHS England estimated the overall number of cancelled appointments at around 19,494, based on the normal rate of follow-up appointments that would have accompanied them⁶. The review also found that at least 139 patients had an urgent referral for potential cancer cancelled as at 18 May⁶. Those patients were re-contacted and their appointments rearranged, which is the pattern the NHS follows: the organisation that booked your care contacts you if it cannot go ahead.

Two things are worth knowing about how this works in practice. First, the NHS was not a specific target of WannaCry; the attack particularly affected the NHS, but the ransomware spread opportunistically, including through the broadband network connecting NHS sites in England¹. Second, national systems held up: NHS Digital's national IT systems, including the NHS Spine, which holds secure databases of demographic and clinical information, and NHSmail, the NHS email system, were not infected⁶. That is one reason disruption stayed local rather than becoming national.

If you hear about an NHS cyber attack in the news and have something booked:

• Check the NHS App²
• Look for a text, call or letter from the hospital or practice that booked you, since cancellations come from them directly
• Call the number on your appointment letter if you have heard nothing and want certainty
• Call NHS 111 if you cannot reach your practice and need urgent advice⁷

If your concern is getting medicines while GP or pharmacy systems are down, see our separate guide to prescriptions during an IT outage.

What A&E does when one hospital is hit

A&E departments do not close because of a cyber attack. During the Synnovis incident, NHS England stated plainly that all urgent and emergency services, including A&E, urgent care centres and maternity departments, remained open as usual². The same applied to emergency care during WannaCry, though a handful of departments came under real strain.

On 13 May 2017, five acute trusts, in London, Essex, Hertfordshire, Hampshire and Cumbria, were operating some diverts from their A&E departments, and a further two needed outside help to continue treating patients⁶. The diverts were lifted on 16 May¹. A divert means ambulances are sent to a different emergency department for a period, and the NHS used its "mutual aid" processes: where one A&E could no longer take patients, nearby A&Es stepped up to take their demand, and some patients from five hospitals travelled further for emergency treatment than normal¹. Hospitals not affected by an attack create capacity to take patients from those that are².

What this means for you as a patient:

• In a genuine emergency, call 999 or go to A&E. NHS guidance is explicit that people should still call 999 and go to A&E when someone is seriously ill or injured and their life is at risk³
• If your need is urgent but not life-threatening, call NHS 111 first. In Surrey and Sussex, patients who need urgent NHS care are asked to call NHS 111 before they decide to walk into the local A&E⁸
• If you do arrive at A&E without contacting NHS 111, you will still receive medical care, with emergency treatments prioritised⁹
• Some visits to A&E and calls to 999 could be resolved by other NHS services, so if the condition is not critical, choose another service⁷

Blood tests and pathology: what the Synnovis attack meant

The Synnovis attack in June 2024 is the clearest example of a cyber attack disrupting tests rather than emergency care. Synnovis provides pathology services, including blood, urine and specimen testing, to a number of healthcare organisations in south-east London⁵. On 3 June 2024 it was the victim of a ransomware cyber-attack⁵, which significantly reduced its capacity to process tests and caused significant disruption across a range of treatments in south-east London².

The numbers for patients were substantial. As a result of the attack, 10,152 acute outpatient appointments and 1,710 elective procedures were postponed at King's College Hospital NHS Foundation Trust and Guy's and St Thomas' NHS Foundation Trust¹⁰. The impact was greatest in south-east London, within Synnovis's partner trusts and their local boroughs, and appointment cancellations were confined to that area⁵. Elsewhere in the country, blood tests and other services continued as normal.

Two reassurances came out of the incident. Synnovis put additional resources in place so that urgent samples received from GPs or hospitals could still be processed within appropriate timeframes². And the disruption was time-limited: services were fully restored by December 2024, and NHS England now states the incident is no longer causing disruption to patient appointments or services⁵. The re-booking of tests and appointments meant some disruption was still felt over the coming months after the attack itself², so if you had a test postponed and have not been re-contacted, chase it with your GP or hospital.

For the full story of that incident, see our page on the Synnovis ransomware attack and London pathology.

NHS 111 and other ways to get help when systems are down

NHS 111 is the service to use when you need urgent medical help but it is not an emergency. It is the NHS non-emergency number: call 111 or visit 111 online, and advisers assess your symptoms and direct you to the best medical care⁷. The service is available 24 hours a day, seven days a week³, by phone, online or via the NHS App¹¹.

111 online can be reached through the website 111.nhs.uk or the NHS App on a smartphone or tablet, and there are accessible routes too: British Sign Language via signvideo, and text relay on 18001 111¹². It helps people with an urgent medical need to get assessed and directed to the right care, especially if they cannot contact their GP or their GP is closed¹².

Depending on what you need, you might be advised to¹²:

• Call 999 or go to A&E in an emergency
• Go to an urgent treatment centre
• See an evening and weekend GP, the out-of-hours service
• Book a callback from a nurse
• Get urgent specialist support, for dental or mental health problems
• Contact your own GP surgery
• See a pharmacist for help with a minor illness
• Look after yourself safely at home

You might also be referred to other urgent care services you can visit yourself, such as A&E, an urgent treatment centre, a walk-in centre or evening and weekend GPs¹³. NHS 111 can book you an appointment at an urgent treatment centre, an emergency dental service or a GP, and can even book you an appointment at A&E if necessary¹¹. GP appointments are available seven days a week in the evening, at weekends and on bank holidays; call your practice, or if your practice is closed, call NHS 111 to book¹¹.

Calls to 111 are recorded, and the records are maintained securely and only shared with others directly involved with your care³. If you rely on other services during a wider outage, our guide to staying informed and in touch in an emergency covers keeping phones and radios working, and our page on when banks, shops and public services go offline covers the rest of the household picture.

How long NHS IT outages actually last

The honest answer is that it varies considerably with what has been hit, and past incidents give a realistic range.

The WannaCry emergency response lasted one week⁶. NHS England declared the cyber attack a major incident at 4 pm on 12 May 2017 and implemented its emergency arrangements to maintain health and patient care⁶, and it stood down the incident on Friday 19 May⁶. Recovery of general practice was fast: 95 per cent of infected GP practices were re-installed and patched by 17 May, with the remaining 5 per cent completed by Friday 19 May¹.

The WannaCry attack of May 2017 shows how the timelines differ. NHS England's emergency response lasted one week⁶, and the incident was stood down on Friday 19 May⁶. Most GP practices recovered quickly: 95% of infected practices were re-installed and patched by 17 May, with the remaining 5% completed by Friday 19 May⁴. But disruption to planned care lasted beyond the response itself: NHS England identified 6,912 appointments that had been cancelled, and at least 139 patients had an urgent referral for potential cancer cancelled, as at 18 May⁶. So: emergency arrangements are usually stood down within days or a week, but disruption to planned care, tests and routine systems can last longer.

One point of context for households planning ahead: the National Risk Register notes that in a severe nationwide loss of power scenario, full restoration could take up to 7 days, with restoration of critical services potentially taking several months¹⁰. An NHS IT outage is not the same as a power cut, but the lesson for households is similar: keep a week's resilience in your planning. Our getting started guide and emergency kit pages set out the basics.

Scam calls and emails after a data breach

After any cyber attack in which data may have been stolen, criminals follow up with scam messages, sometimes weeks later. NHS England's advice after the Synnovis incident is that you will never be asked for personal or financial information when contacted about the incident, and Synnovis will not contact patients directly: any notification will come from an NHS organisation, as determined by UK data protection laws¹. Be alert to suspicious messages, which may be sent some time after a breach is made public, and remember that your bank or any other official organisation will never ask you to supply personal information by email¹.

The single most useful rule is this: the NHS will never ask you for personal or financial information when contacting you about an incident. NHS England's own words on the Synnovis incident:

The National Cyber Security Centre (NCSC) gives the same warning for banks and other official organisations: your bank, the police, or real companies will never ask for your details in an email, text, or phone call, and caller ID can be spoofed easily, so do not trust a displayed telephone number¹⁴. If you are contacted about an NHS incident, do not use an address or phone number given in the message itself; use the contact details from the official organisation's website⁵.

Warning signs the NCSC lists for scam messages following a breach include official-sounding messages about "resetting passwords", "receiving compensation", "scanning devices" or "missed deliveries", emails full of technical jargon, and being urged to act immediately or within a limited timeframe¹⁵. Ofcom's guidance on scam calls and texts describes phishing emails that claim to be from the NHS but are in fact sent by scammers: they can be quite convincing at first glance, but by checking the sender you can see where they have come from, and you should not click on any links in them¹⁶.

If you think an account of yours has been accessed, the NCSC has guidance on recovering a hacked account¹⁵, and if your email address was hacked, check for any "auto forwarding rules", which criminals add to retain access to your inbox even after you change passwords¹⁴. Our pages on spotting scam messages after a data breach, telling whether an NHS email or text is genuine and recovering a hacked email account go through the steps in detail.

Where to report a scam or a cyber crime

Reporting takes a minute and costs nothing, and it lets the authorities investigate and block the senders.

Suspicious texts: forward the message to 7726. It is free⁴. 7726 is a spam-reporting service provided by phone operators; reporting costs nothing and can reduce the amount of scam texts you receive¹⁷. Most phone providers are part of the scheme, and your provider can investigate the origin and block or ban the sender if it is malicious¹⁸. With scam "missed parcel" texts in particular, the NCSC's instructions are: do not click the link in the message, do not install any apps if prompted, forward the message to 7726, then delete it¹⁷. If 7726 does not work, contact your phone provider to find out how to report a text message¹⁸.

Suspicious emails: forward them to report@phishing.gov.uk, the NCSC's Suspicious Email Reporting Service, which will investigate them⁴. The NCSC's advice on phishing is not to engage with the phisher: forward the email, then delete it²⁰. NHS England gave the same instruction to patients during the Synnovis incident: send suspicious emails to report@phishing.gov.uk or texts to 7726⁵.

Fraud and cyber crime: if you think you have been the victim of a cyber crime or fraud, call Action Fraud, the UK's national reporting centre for fraud and cybercrime, on 0300 123 2040, or textphone 0300 123 2050, or report online at www.actionfraud.police.uk⁵. NHS England directed patients targeted by fraud after the Synnovis incident to Action Fraud⁵.

Scam websites: you can also report suspicious websites to the NCSC²¹.

If you received the message on a work laptop or phone, contact your IT department and tell them what has happened²¹. Our narrow guides on reporting a scam text and reporting a phishing email walk through each step with screenshots of the process.

Did the NHS pay a ransom?

No NHS organisation paid the WannaCry ransom. The Department of Health and Social Care, NHS England and the National Crime Agency all confirmed this²², and the NHS's own lessons learned review states the same, noting that standing advice not to pay was re-circulated by the NCSC during the incident¹. NHS Digital advised the trusts it spoke to not to pay, and wrote to all trusts on 14 May 2017 advising against the payment of ransoms⁶.

The reasoning behind that advice applies to households as much as hospitals. The NCSC's guidance for home users explains that paying a ransom gives no guarantee you will get access to your data, your computer will still be infected unless you complete extensive clean-up activities, and you will be paying criminal groups²³. The NCSC's annual review makes the same point bluntly: after paying, computer or networks will still be infected²⁴.

Ransomware attacks on the NHS were not a one-off. Before WannaCry, Northern Lincolnshire and Goole NHS Foundation Trust had been subject to a ransomware attack in October 2016, which led to the cancellation of 2,800 appointments⁶, and Barts Health NHS Trust suffered a cyber attack in January 2017⁶. Between September 2021 and August 2022 the NCSC co-ordinated the national response to 18 ransomware attacks²⁴. For what ransomware is and how it reaches households, see our ransomware guide, and for the 2017 attack itself, our page on WannaCry.