The Synnovis Ransomware Incident and London NHS Pathology

On 3 June 2024, Synnovis, a pathology laboratory that processes blood tests for NHS organisations primarily in south-east London, was the victim of a ransomware cyber-attack¹. The attack stopped its systems working, and as a result 10,152 acute outpatient appointments and 1,710 elective procedures were postponed at King's College Hospital NHS Foundation Trust and Guy's and St Thomas' NHS Foundation Trust². Blood tests, appointments and operations were all affected³.

The position today is that the incident is over as a service problem. NHS England states that services were fully restored by December 2024 and that the incident is no longer causing disruption to patient appointments or services¹. What continues is the aftermath: data was stolen during the attack, criminals have tried to publish it, and people claiming to hold it may try to contact patients. NHS England's advice is plain: you will never be asked for personal or financial information by the NHS about this incident, and you should be alert to anyone who asks¹.

This page explains what happened, where the disruption fell, what it meant for blood tests and operations, what became of the stolen data, and exactly what to do if you are contacted by someone claiming to have it.

What happened: ransomware hit London NHS pathology

Synnovis is a pathology laboratory that processes blood tests on behalf of several NHS organisations, primarily in south-east London². It is co-owned by Guy's and St Thomas' NHS Foundation Trust, King's College Hospital NHS Foundation Trust and SYNLAB, a private laboratory company¹. On 3 June 2024 it was the victim of a ransomware cyber-attack¹.

Ransomware is a type of malicious software that locks or encrypts an organisation's systems and data, with criminals demanding payment to restore access. You can read more about how it works and how it can affect households in our guide to ransomware. In Synnovis's case, the attack took out the IT systems a laboratory depends on to receive requests, process samples and return results to hospitals and GP surgeries. Synnovis responded by exploring work with other laboratories in the local area and further afield to increase test processing capacity³.

The attack is being investigated by law enforcement agencies³. Synnovis also reported the incident to the Information Commissioner's Office, the UK's data protection regulator, and has been in regular contact with it ever since¹.

This was not the first ransomware attack on the NHS

The NHS in England has been hit by ransomware before, and the history explains why the response to Synnovis was as large as it was. In October 2016 a ransomware attack on Northern Lincolnshire and Goole NHS Foundation Trust led to the cancellation of 2,800 appointments⁴. In May 2017 the WannaCry ransomware affected at least 80 out of the 236 trusts across England, because they were either infected by the ransomware or locked out by their own protections; of the 37 trusts infected and locked out of devices, 32 were located in the North NHS Region and the Midlands and East NHS region⁵. WannaCry was the largest cyber attack to affect the NHS in England, although the NHS was not its specific target⁴. Our page on WannaCry covers that attack in full.

The lesson learned from those earlier attacks shaped what followed. The Department of Health and Social Care had been warned about the risks of cyber attacks on the NHS a year before WannaCry, and reviews after it found that all NHS organisations infected had unpatched or unsupported Windows operating systems, which left them susceptible⁵. Since June 2024, the NHS Cyber Improvement Programme has been supporting the NHS to respond to changing cyber threats, expand protection and reduce the risk of a successful attack¹.

Ransomware against critical services is a recognised national risk, not a one-off. Hackney Council experienced a major ransomware attack in October 2020, which disrupted council services for months⁷. The National Risk Register records that as a result of the Synnovis attack, 10,152 acute outpatient appointments and 1,710 elective procedures were postponed at the most affected trusts².

Where the disruption hit hardest: south-east London

The impact of the Synnovis attack was greatest in south-east London, within Synnovis's partner trusts and their local boroughs, and appointment cancellations were confined to south-east London¹. NHS England describes the attack as having caused significant disruption in south east London across a range of different treatments³.

The two trusts at the centre were King's College Hospital NHS Foundation Trust and Guy's and St Thomas' NHS Foundation Trust, the co-owners of Synnovis alongside SYNLAB¹. Because pathology is a shared service, the effects reached beyond the hospital walls: blood tests ordered by GP surgeries and outpatient clinics across the partner trusts' boroughs all depended on the same laboratory. If you had a blood test, appointment or operation affected in June 2024 and you were treated in south-east London, this incident is likely to have been the cause.

Elsewhere in England, the NHS continued to run normally. That is a marked difference from WannaCry in 2017, which led to disruption in at least 34% of trusts in England, concentrated in the North and Midlands and East regions⁵. A localised attack can still be a large one: the numbers postponed at the two Synnovis partner trusts alone ran into five figures².

Cyber threats to public services are not unique to London. Essex, for example, faces significant cyber security threats because of its interconnected infrastructure, digital economy and reliance on technology across public services, businesses and residents, and its economic and technological integration with London increases its exposure to threats targeting the capital⁸. The London Risk Register scores cyber attacks as likelihood 3 and impact 2⁹.

Blood tests, appointments and operations affected

The attack resulted in the cancellation of appointments and operations affected by the attack, with blood tests among the services hit³. Synnovis is a pathology laboratory which processes blood tests on behalf of several NHS organisations, primarily in south-east London², so when its systems went down, the tests could not be processed at the usual rate.

For patients, that meant three kinds of impact:

• Blood tests could not be processed normally, so some were delayed, redirected to other laboratories or rescheduled. Synnovis explored opportunities to work with other laboratories in the local area as well as further afield to increase test processing capacity³.
• Appointments that depended on test results were postponed, because clinicians could not act on results they did not have.
• Operations, including elective (planned) procedures, were postponed where pre-operative blood work or pathology support was unavailable².

NHS England warned that the need to rebook tests and appointments would mean some disruption from the cyber incident would be felt over coming months³. That is the normal shape of a pathology outage: the laboratory may be restored, but the backlog of postponed work takes longer to clear. Short-term excessive demands on hospitals can lead to delays in the system for several weeks, as the National Risk Register notes of surges in demand generally².

If you are still waiting for a rebooked appointment, contact the NHS organisation that originally booked it, in the usual way, using its official contact details. Our guide to NHS appointments, A&E and tests during an IT outage covers what to do more broadly when health services lose their systems.

The scale of postponements at King's College Hospital

The clearest measure of the attack's effect on patients is the postponement count. As a result of the attack, 10,152 acute outpatient appointments and 1,710 elective procedures were postponed at King's College Hospital NHS Foundation Trust and Guy's and St Thomas' NHS Foundation Trust, the most affected trusts².

Two things are worth drawing out from those figures. First, the burden fell on planned care rather than emergency care: outpatient appointments and elective procedures are booked in advance, which is why they could be postponed rather than lost. Second, the figures cover the two most affected trusts, so the true number of patients touched by delayed blood results across GP surgeries and clinics in the affected boroughs will have been wider still, though NHS England has not published a figure for that.

For comparison, the WannaCry attack of 2017 disrupted at least 80 out of 236 trusts across England⁴, but the Synnovis attack shows that a single supplier can cause comparable local disruption: one laboratory serving two large trusts was enough to postpone nearly twelve thousand appointments and procedures².

Who will contact you about your data

Data was stolen during the attack, and criminals published some of it. Synnovis obtained a legal injunction to prevent people from using or further publishing the data¹. Synnovis reported the incident to the Information Commissioner's Office and has been in regular contact with them ever since¹.

The key point for households is who makes contact. Synnovis will not be contacting patients directly, as determined by UK data protection laws¹. If patients need to be notified about their data, that notification will come from an NHS organisation¹. So a message that arrives "from Synnovis" addressed to you as a patient is not a genuine notification route, whatever else it claims.

NHS England's instruction to patients is unambiguous:

That applies to any contact about this incident. If someone asks for your bank details, passwords, identity documents or other personal information in connection with the Synnovis incident, they are not from the NHS.

If you want to understand your wider position after a data breach, our guide on your details in a data breach explains what a breach means for you and what steps help. The NCSC's guidance for individuals and families notes that after a breach you should be alert to suspicious messages, as cyber criminals may try to take advantage of it¹⁰.

Never give personal or financial details to anyone claiming to have your data

NHS England's advice is to always be alert to approaches from anyone claiming to have your data, and to any suspicious calls or emails asking for personal or financial data¹. This is the single most important protective action for anyone affected by the Synnovis incident, because stolen data gives criminals material to make their approaches sound convincing.

The rules that follow come from official guidance and apply to any message or call, not just ones mentioning Synnovis:

• Never provide personal or financial information when contacted about the incident. NHS England states you will never be asked for it¹.
• Your bank, the police, or real companies will never ask for your details in an email, text, or phone call, and caller ID can be spoofed easily, so do not trust a displayed telephone number¹².
• Never provide bank or card details to anyone who has contacted you unannounced, and never give your bank card or PIN number to a stranger¹³.
• Do not give out private information such as bank details or passwords, do not reply to suspicious text messages, and do not download attachments or click links in emails you are not sure are genuine¹⁴.
• Do not reuse the same password on different online accounts¹⁵.

How to spot the approaches

The NCSC's guidance on data breaches lists the warning signs to look out for in messages that follow a breach: official-sounding emails about "resetting passwords", "receiving compensation" or "confirming identity", emails full of "tech speak", and being urged to act immediately or within a limited timeframe¹⁷. Ofcom has found that scam calls and texts have claimed to be from the Government, GP surgeries, the NHS and even the World Health Organisation¹⁸, so an NHS or Synnovis badge on a message proves nothing.

If you receive a message or call about a security breach that doesn't feel right, report it using the routes below rather than responding¹⁷. Our page on scam messages after a data breach goes further into the patterns criminals use.

How to report suspicious emails, texts and calls

NHS England's instruction for the Synnovis incident is to send suspicious emails to report@phishing.gov.uk or texts to 7726¹. Those two routes are free, run in partnership with the NCSC, and take a minute to use.

Emails. Forward suspicious emails to the NCSC's Suspicious Email Reporting Service at report@phishing.gov.uk²¹. The NCSC will investigate what you send¹⁴. Reporting is free, takes only a minute, reduces the scam emails you receive, makes you a harder target and protects others from cyber crime²².

Texts. Forward suspicious text messages to 7726, a free spam-reporting service provided by phone operators²³. Most phone providers are part of a scheme that allows customers to report suspicious text messages for free by forwarding them, so your provider can investigate the origin and block or ban the sender if malicious²⁴. The purpose of a scam text is often to get you to click a link that takes you to a website criminals use to download viruses or steal passwords or personal information²⁴. As of September 2026, 41.9 K scams had been removed across 93.3k URLs as part of the 7726 service²⁴. Our page on reporting a scam text gives step-by-step instructions.

If you have already clicked or replied. Do not click the link in the message and do not install any apps if prompted; forward the message to 7726, then delete it¹⁶. If you have logged into any accounts or apps since installing malware, you must change the password for that account and update the same password on any other accounts, making sure they are unique¹⁶. Malware installed from a scam text can steal your banking details, passwords and other sensitive information²³. See our guidance on what to do after clicking a phishing link.

Calls. If you suspect someone is not who they claim to be, hang up and contact the organisation directly using details from their official website²¹. Report fraud to Action Fraud, the UK's national reporting centre for fraud and cybercrime, on 0300 123 2040¹, or online at www.actionfraud.police.uk¹⁹.

Stolen data, the court injunction and the Information Commissioner's Office

During the attack, criminals stole data. Synnovis obtained a legal injunction to prevent people from using or further publishing the data¹. An injunction is a court order: breaching it is contempt of court, and it gives Synnovis and the NHS a legal tool against anyone who tries to trade in or republish the stolen material.

Regulatory oversight runs alongside the legal action. Synnovis reported the incident to the Information Commissioner's Office and has been in regular contact with them ever since¹. Under UK data protection law, it is for the NHS organisation holding the patient relationship to notify affected patients, which is why Synnovis will not be contacting patients directly¹.

For households, the practical meaning of all this is:

• You do not need to chase anyone. If your data requires notification, an NHS organisation will contact you¹.
• Publication of the data is legally restrained. The injunction prevents people from using or further publishing it¹.
• The attack remains under investigation by law enforcement agencies³.
• Personal data breaches can lead to identity theft, so stay alert to suspicious messages that quote your details⁸.

The healthcare sector has long been a focus of data security concerns. The healthcare sector accounted for the highest number of data security incidents reported to the Information Commissioner's Office in the third quarter of 2016, with 74 of the NHS's 239 reports related to cyber security incidents⁶. Reviews by the National Data Guardian and the Care Quality Commission published in July 2016 had already warned the Department of Health about the cyber threat and the need to respond to it⁴. The Synnovis incident is the most recent large demonstration of that risk in the NHS, and the reason the NHS Cyber Improvement Programme has continued since June 2024 to support the NHS in responding to changing cyber threats, expanding protection and reducing the risk of a successful attack¹.

What you can do now

For most households, three actions cover the Synnovis incident and anything like it:

1. Check any contact against official channels. Never use the links or contact details in any message you have been sent¹⁰. Contact the organisation directly using details from their official website; official contact details are often written on paper statements or credit cards too²¹. Our page on how to tell if an NHS email or text is genuine helps here.
2. Report what you receive. Forward suspicious emails to report@phishing.gov.uk and texts to 7726¹. If you have been a victim of fraud or cybercrime, contact Action Fraud on 0300 123 2040¹.
3. Protect your accounts. Do not reuse the same password on different online accounts¹⁵, and keep your devices patched: many organisations hit by ransomware had not applied the recommended software updates in a timely manner, which left systems vulnerable¹⁵. Our guides on protecting your accounts and software updates set this out step by step.

If you were affected as a patient, services are restored and appointments are no longer being disrupted by this incident¹; contact your NHS organisation in the usual way about any rebooking. For the wider picture of how the NHS, government and regulators handle incidents like this one, see how services respond to a major incident, and for the general household approach to online threats, our home online security checklist.