Cyber criminals publish data claimed to be stolen from Synnovis

A cyber criminal group published data on the night of 20 June 2024 which it claimed belonged to Synnovis and was stolen in the ransomware attack on the laboratory, NHS England said. Synnovis processes blood tests for a number of NHS organisations, primarily in south-east London¹. The National Crime Agency and the National Cyber Security Centre were working to verify the data included in the published files¹.

NHS England said the attack meant the NHS could not use some of its systems essential to run blood tests in south-east London, and that appointments and operations had been postponed as a result¹. All urgent and emergency services, including A&E, urgent care centres and maternity departments, remained open as usual, although there might be some delays where blood tests were required¹. Outpatient and community services were mostly running as usual, including cervical screening¹.

On the data itself, NHS England said the files were "not simple uploads" and that investigations of this nature were highly complex and could take weeks if not longer¹. It said patients should not contact their local hospital or GP practice to ask whether their data had been affected, because those organisations did not hold that information¹. An incident helpline was set up on 0345 8778967¹.

Later statements add detail. On 24 June 2024, NHS England said Synnovis had confirmed through an initial analysis that the published data had been stolen from some of its systems, and that there was at present no evidence the criminals had published a copy of the Laboratory Information Management System where patient test requests and results are stored, although investigations continued³. It said it might be some weeks before it was clear which individuals had been affected³. NHS England's incident page, updated on 10 November 2025, records that the criminals published the stolen files on 20 June 2024, that services were fully restored by December 2024, and that the attack caused delays to over 11,000 outpatient and elective procedure appointments⁴. It also states that the stolen data may potentially relate to any of Synnovis' service users, including some NHS hospitals, GP practices and clinics across England, while appointment cancellations were confined to south-east London⁴.

Why it matters for households

The published data came from Synnovis' administrative working drive, which supported corporate and business support activities, and is separate from the laboratory database holding the majority of test requests and results⁵. An initial analysis identified some personal data such as names, NHS numbers and test codes; for some patients it may include a date of birth, and for others test results or numerical values such as blood sugar level⁵. Not all of the stolen data relates to patients, and where it does the type varies from person to person⁵.

Synnovis will not contact patients directly; any notification will come from an NHS organisation, which may write to individuals or publish information on its website, and timescales are likely to differ between organisations⁴. NHS England advises people to be alert to approaches from anyone claiming to have their data, particularly where personal or financial information is requested, and to contact Action Fraud on 0300 123 2040 if contacted by someone making such a claim⁵. Suspicious emails can be sent to report@phishing.gov.uk and suspicious texts to 7726⁵. NHS England says patients will never be asked for personal or financial information, and that anyone receiving an unexpected message claiming to be from the NHS should check it using contact details from the official organisation's website rather than those in the message⁵. It also says the incident is no longer causing disruption to patient appointments or services⁵. The NCSC publishes guidance on data breaches for individuals and families, and its help for individuals and families sets out where to report concerns.

What happens next

Synnovis is contacting its impacted customers, including some NHS hospitals, GP practices and clinics, and each organisation will then review copies of its stolen data to establish what it contains and whether individuals need to take any steps⁴. NHS England says this assessment may take some time and that organisations may be required to notify the Information Commissioner's Office and contact patients⁵. Synnovis reported the incident to the Information Commissioner's Office and obtained a legal injunction to prevent people from using or further publishing the data⁴. NHS England continues to publish updates on its Synnovis incident pages⁴. The background to the attack and the response of the NHS and regulators are set out in our guides to the Synnovis ransomware incident and how the NHS, government and regulators respond to a major incident.