NHS England London said a ransomware cyber attack was carried out on Monday 3 June against Synnovis, a pathology laboratory that processes blood tests for a number of NHS organisations, primarily in South East London1. In response, NHS England London declared a regional incident and coordinated work across affected services, neighbouring providers and national partners to manage the disruption1.
NHS Blood and Transplant called out to O Positive and O Negative blood donors to urgently book appointments at one of the 25 town and city centre NHS Blood Donor Centres in England over the following weeks, to boost stocks of O type blood following the cyber incident1. Appointments can be booked at blood.co.uk or by calling 0300 123 23 23, NHS England London said1. It added that it was working with NHS Blood and Transplant to provide extra stocks of "universal" blood types1.
The first week of figures after the attack, covering 3 to 9 June, are drawn from unvalidated management information that NHS England London said it would now publish weekly in the public interest1. Across the two most affected trusts, King's College Hospital NHS Foundation Trust and Guy's and St Thomas' NHS Foundation Trust, the figures were1:
| Measure | Number (3 to 9 June) |
|---|---|
| Elective procedures postponed | 814 |
| Of these, cancer treatments | 97 |
| Organs diverted for use by other trusts | 18 |
| Planned C-sections postponed or rescheduled | 5 |
| Hospital outpatient appointments postponed | 736 |
| Community outpatient appointments postponed | 125 |
NHS England London said the majority of diverted organs were kidneys, and that the majority of planned activity had continued to go ahead, with some specialities affected more than others1. South East London pathology services were being provided at approximately 10% of normal capacity, with half of that capacity ringfenced for patients in the two acute trusts1. Guy's and St Thomas', King's College Hospital and South London and Maudsley NHS Foundation Trusts remained in a critical incident, while Oxleas NHS Foundation Trust, Lewisham and Greenwich NHS Trust, Bromley Healthcare and primary care services in South East London continued to be significantly impacted1.
Dr Chris Streather, Medical Director for NHS London, said:
"Having treatment postponed is distressing for patients and their families, and we apologise to all those who have been impacted, and staff will work hard to re-arrange appointments and treatments as quickly as possible."
Why it matters for households
The impact is concentrated in South East London. All unplanned services, including A&E, were open as normal, and urgent and emergency services in the local area were available as usual1. NHS England London advised patients to access services in the normal way by dialling 999 in an emergency and otherwise using NHS 111 through the NHS App, online or on the phone1. Any patient with a planned appointment at the two most affected trusts who had not been contacted should attend as normal, it said, with changes to treatment communicated by text, phone and letters1.
Primary care appointments were going ahead as normal, but blood tests were being prioritised for urgent cases, and GP referrals were significantly impacted, with only urgent referrals accepted for blood sciences (haematology, biochemistry, immunology and virology)1. Normal services were operating for histology and cervical smears1. Optional blood borne virus tests for HIV, hepatitis C and hepatitis B, offered to A&E patients as part of a trial, were suspended1.
NHS England London said that where there is a ransomware attack there is always a risk that cyber criminals also access data, and that investigations were continuing to establish any possible impact to data1. It pointed to National Cyber Security Centre advice for the public on spotting and protecting against cyber crime1. The incident and its background are set out in the guide to the Synnovis ransomware incident and London NHS pathology, with wider material in the cyber-attacks hub.
What happens next
NHS England London said updates would be provided weekly as the incident continued, with the next update due on Friday 21 June1. Synnovis was focused on the technical recovery of its system, with plans to begin restoring some functionality in the weeks to come, but full technical restoration would take some time and disruption was expected to continue to be felt over coming months1.
