What happened when ransomware hit London's hospital blood-test provider in 2024?
On 3 June 2024 a ransomware attack on one pathology provider disrupted several London hospitals, and patient data was stolen.
A ransomware attack on Synnovis, a provider of services to several London hospitals, compromised patient and clinician confidential data and disrupted NHS services starting on 3 June 2024. Hospitals cancelled operations and diverted emergency patients, and on 24 June NHS England confirmed that data managed by Synnovis had been stolen.
Who are Synnovis? It is a London-based provider of services, a partnership between Guy's and St Thomas' NHS Foundation Trust, King's College Hospital NHS Foundation Trust and SYNLAB UK & Ireland. It provides pathology services to the Princess Royal University Hospital, Guy's, St Thomas' and King's College hospitals. That is why an attack on one supplier could ripple through several hospitals.
What is ransomware? It is that takes a victim's private data hostage until a ransom is paid. This can involve encryption of the data, and/or with the threat of publicly releasing it. Qilin, a Russian-speaking cybercrime organisation, has been linked to a ransomware attack on hospitals in London.
Step 1: A supplier is hit
Synnovis succumbs to ransomware
Step 2: Hospitals that rely on it are disrupted
Operations cancelled, emergency patients diverted
Step 3: Data is stolen
NHS England confirms it on 24 June
Why does stolen medical data matter? Medical data, such as identity information, health status, diagnoses and treatment, involves patients' privacy and has special sensitivity and value, and leaks may bring physical and mental distress and losses. In 2015 a Beazley employee estimated that medical records could sell on the black market for US$40-50.
The law also has a say. Under the GDPR a controller must report a breach to the without undue delay, within a maximum of 72 hours of becoming aware, unless the breach is unlikely to risk individuals' rights and freedoms.
Quiz me
0/3
Recap
Ransomware can stop services and steal data at the same time, and medical data is especially sensitive.
💡 A trick to remember it · A hospital is a chain, and an attack on one link, the lab, pulls on every ward connected to it.
Surprising fact · NHS England confirmed on 24 June 2024 that data managed by Synnovis had been stolen.
Sources (8)
No source, no claim. Every fact in this lesson (17 claims) cites at least one of these.