Cyber attack on Synnovis postponed over 11,800 NHS appointments and procedures

A cyber attack on the NHS pathology provider Synnovis resulted in the postponement of 10,152 acute outpatient appointments and 1,710 elective procedures, according to the 2025 edition of the National Risk Register¹. The figures relate to King's College Hospital and Guy's and St Thomas' trusts¹. The National Risk Register is the government's public assessment of the risks the UK faces, and the incident is cited in it as an example of a cyber attack on the health and social care system¹.

The register sets out how such risks are assessed. It includes plausible information about 89 risks within 9 risk themes, and likelihood is scored on a scale from 1 to 5, where 1 represents the lowest likelihood and 5 the highest¹. The register states that a score 3 risk is approximately 5 times more likely to occur than a score 2 risk¹. Impact is assessed across 7 broad dimensions, each scored on a scale of 0 to 5, with fatalities banded from 1 to 8 at the lowest through to more than 1,000 at the highest¹. The assessment period is 5 years for non-malicious risks and 2 years for malicious risks¹.

The register also places technology failure alongside malicious cyber attack. It states:

The same edition notes that in May 2024 the Government published advice for individuals, households and communities on GOV.UK/Prepare on preparing for emergencies¹. It adds that this edition of the register is not targeted at the general public¹.

Why it matters for households

The postponements show how a cyber attack on a single supplier can affect routine NHS care across more than one trust, with appointments and procedures moved rather than cancelled outright. Households in the areas served by King's College Hospital and Guy's and St Thomas' trusts were the ones affected in this incident¹. The register does not set out, for this incident, how patients were contacted or how soon appointments were rearranged; those details have not been reported here.

For households preparing for disruption to services, the site's guide to NHS appointments, A&E and tests during an IT outage covers what changes when NHS systems go offline, and the guide to how the NHS, government and regulators respond to a major incident explains the response structure. The checklist for banks, shops and the NHS going offline sets out household preparations, and the guide to the Synnovis ransomware incident and London NHS pathology covers that event in more detail. The cyber-attacks hub collects the related guidance.

The register describes the wider system that responds to such events, naming the 38 Local Resilience Forums in England, the 4 in Wales, 3 Regional Resilience Partnerships in Scotland and Emergency Preparedness Groups in Northern Ireland¹. It also notes that the National Security Risk Assessment now operates as a dynamic process, with risks reassessed more regularly to reflect the changing risk landscape¹.

What happens next

The register records that the Government published household preparedness advice on GOV.UK/Prepare in May 2024¹. It states that this edition of the National Risk Register underpins that public guidance¹. No further dated steps specific to the Synnovis incident are given in the register.