Cyber attack hits Synnovis pathology services

A ransomware attack on Synnovis, a pathology laboratory that processes blood tests for NHS organisations mostly in south east London, disrupted services from 3 June 2024, NHS England said. In an update published on 4 October 2024, NHS England London reported that the final stages of recovery were almost complete and that nearly all services were up and running¹.

The attack meant the NHS could not use some of its systems essential to running blood tests in south east London². NHS England London said that 10,152 acute outpatient appointments and 1,710 elective procedures were postponed at the most affected trusts, King's College Hospital NHS Foundation Trust and Guy's and St Thomas' NHS Foundation Trust¹. Its weekly updates trace the cumulative figures rising through the summer: more than 7,000 outpatient appointments and over 1,500 elective procedures by 19 July³, 8,349 and 1,608 by 25 July⁴, 10,054 and 1,693 by 15 August⁵, and 10,146 and 1,705 by 19 September⁶. NHS England London stated that all numbers quoted were drawn from unvalidated management information, provided in the interests of transparency⁷.

Because the affected trusts could not carry out "cross-matching" for blood transfusions, they had to use O-type blood, which is safe for all. This contributed to a national shortage of O-type blood supplies¹. NHS Blood and Transplant wrote to hospitals across the country on 25 July issuing an "Amber Alert" asking them to restrict the use of O type blood to essential cases and use substitutions where clinically safe to do so⁴. The amber alert for blood supplies remained in place at the start of October¹.

The services most affected were in south east London. Alongside the two main trusts, Oxleas NHS Foundation Trust, Lewisham and Greenwich NHS Trust, Bromley Healthcare and primary care services in south east London were all affected¹. On data published on 24 June, NHS England said a cyber criminal group had published data it claimed belonged to Synnovis and was stolen in the attack, and that the National Crime Agency and National Cyber Security Centre were working to verify it². Synnovis said historic test results would be available to clinicians once IT systems were restored, but that some stored samples were no longer suitable for analysis and would need to be discarded².

Why it matters for households

The disruption fell on households in south east London using GP blood tests, outpatient appointments and planned procedures at the affected trusts, and on blood donors nationally. NHS England advised patients to continue to attend booked appointments unless contacted to say otherwise, to use NHS 111 through the NHS App, online or by phone for non-urgent care, and to dial 999 in an emergency in the normal way⁷. Patients waiting on blood tests were advised to keep an eye on Swiftqueue, the online booking service, as more appointments became available⁷. NHS Blood and Transplant urged new and existing O negative and Black heritage donors to come forward, with new donors asked to visit one of 25 NHS donor centres across towns and cities¹. On data published in June, NHS England advised people to be alert to approaches from anyone claiming to have their data, to contact Action Fraud on 0300 123 2040 if contacted by someone claiming to hold it, and to send suspicious emails or texts to 7726. It said people should not contact their local hospital or GP practice to ask whether their data was affected, as they do not hold that information, and gave an incident helpline on 0345 8778967². The Synnovis incident guide sets out the background, and the NHS appointments and tests guide covers what changes during an IT outage.

What happens next

Synnovis said its first phase of restoration was complete, with service users able to access almost all services available before the attack, but that work remained to restore business administrative IT systems¹. NHS England London said some important administrative work remained, though any further impact on patient care would be minimal¹. Rebuilding blood stocks was expected to take some time, with the shortage alert still in place¹. The National Crime Agency and National Cyber Security Centre investigation into the published files was described in June as highly complex and potentially taking weeks if not longer²; no outcome is given in these updates.