Synnovis services fully restored after cyber-attack

Synnovis, the pathology provider co-owned by Guy's and St Thomas' NHS Foundation Trust, King's College Hospital NHS Foundation Trust and SYNLAB, was the victim of a ransomware cyber-attack on 3 June 2024, NHS England has said. In an update dated 10 November 2025, it confirmed that services were fully restored by December 2024 and that the investigation into what data was stolen is now complete¹.

The attack disrupted Synnovis' services across the UK and significantly reduced its capacity to process tests, causing delays to over 11,000 outpatient and elective procedure appointments. The impact was greatest in south-east London, within Synnovis' partner trusts and their local boroughs, and appointment cancellations were confined to that area. Data stolen in the attack, however, may potentially relate to any of Synnovis' service users, including some NHS hospitals, GP practices and clinics across England¹. Synnovis provides pathology services, including blood, urine and specimen testing, to a number of healthcare organisations including the NHS, and is based in south-east London¹.

On 20 June 2024 the criminals responsible published data files they had stolen. Synnovis obtained a legal injunction to prevent people from using or further publishing the data, and reported the incident to the Information Commissioner's Office, with which it says it has been in regular contact since¹. An initial analysis of the published data identified some personal data such as names, NHS numbers and test codes. According to Synnovis, not all of the stolen data relates to patients, and where it does the type varies from person to person: for some it may include an NHS number, name or date of birth, for others test results or numerical codes such as blood sugar level. The stolen files came from an administrative working drive separate to the database supporting laboratory operations, and Synnovis has confirmed there is no evidence the cyber criminals published that database².

NHS England said the investigation took more than a year because the stolen data was unstructured, incomplete and fragmented¹.

Why it matters for households

Anyone whose data was held by Synnovis, including patients of some NHS hospitals, GP practices and clinics across England, may be affected regardless of where they live, because the stolen data may relate to any service user¹. Synnovis is now contacting its impacted customers, which include some NHS hospitals, GP practices and clinics, and those organisations will review copies of the data to understand what it contains, who it may identify and whether individuals need to take any steps¹. Synnovis will not contact patients directly; any notification will come from an NHS organisation, and may take the form of a letter, an email or a statement on the organisation's website¹. NHS England says timescales are likely to differ between organisations depending on the amount and type of data and the number of individuals involved¹.

NHS England advises people to be alert to approaches from anyone claiming to have their data, and to any other suspicious calls or emails, particularly if asked to provide personal or financial data. It says people will never be asked for personal or financial information, and that anyone contacted by someone claiming to have their data, or claiming to be from Synnovis, should contact Action Fraud, the UK's national reporting centre for fraud and cybercrime, on 0300 123 2040. Suspicious emails can be sent to report@phishing.gov.uk and suspicious texts to 7726. It also advises double-checking unexpected NHS communications by contacting the organisation directly, using details from its official website rather than from the message itself². The National Cyber Security Centre has published guidance for individuals and families on data breaches².

What happens next

Impacted NHS organisations will review the data relating to them and, where necessary, publish information on their websites, including any steps people may need to take, and may write to some individuals. NHS England says it will continue to publish updates, and Synnovis is directing people to its own cyber update questions and answers¹. The full background is set out in the guide to the Synnovis ransomware incident and London NHS pathology, with wider material in the cyber-attacks hub and advice on restoring files safely after ransomware or a virus.