Yes, data linked to the London pathology cyberattack was published—but early official statements did not confirm that the central database of patient test requests and results was among it. Synnovis, a pathology provider serving NHS organisations in south-east London, was hit by ransomware on 3 June 2024. The Qilin ransomware group claimed responsibility and published files around 20–21 June. NHS England and the National Cyber Security Centre investigated what the files contained.
What happened
Synnovis suffered a ransomware attack on 3 June 2024. The company provides blood, urine and specimen testing for healthcare organisations, so the incident affected clinical services rather than just a website or office network. NHS England declared a regional incident, reduced testing capacity and arranged support from neighbouring pathology providers.
As an Amazon Associate I earn from qualifying purchases.
The main NHS trusts involved were Guy’s and St Thomas’ NHS Foundation Trust and King’s College Hospital NHS Foundation Trust. The disruption also reached associated hospitals, GP practices and clinics using Synnovis services, including Guy’s Hospital, St Thomas’ Hospital, King’s College Hospital, Royal Brompton Hospital and Evelina London Children’s Hospital. That does not mean every London hospital was directly hacked.
Synnovis is a pathology partnership owned by Guy’s and St Thomas’ NHS Foundation Trust, King’s College Hospital NHS Foundation Trust and SYNLAB. Its role makes the incident an example of healthcare supply-chain risk: one specialist provider can support many otherwise separate organisations.
#1 Best Overall
Timeline: attack, publication and official assessments
- 3 June 2024: Synnovis identified a ransomware cyberattack. Pathology processing and reporting were disrupted.
- First weeks of June: Hospitals prioritised urgent work, rerouted samples and used manual processes. Elective procedures and appointments were rearranged.
- 20–21 June: Qilin published files on its criminal leak channels, claiming they had been stolen from Synnovis.
- 21 June: NHS England said the material was being assessed and confirmed the operational impact of the attack.
- 24 June: NHS England reported that Synnovis had confirmed some published data came from its systems. At that stage, there was no evidence that the main Laboratory Information Management System (LIMS) containing patient test requests and results had been released.
- Later NHS updates: Public guidance described broader categories of information that could potentially be affected and recorded more than 11,000 disrupted outpatient and elective-procedure appointments.
Key statements are available from NHS England’s initial response, its 24 June update and the NCSC statement.
What does “blood-test data leaked” actually mean?
The phrase can describe several different things. A name paired with a test code is not the same exposure as a complete laboratory history with numerical results. Early reports and official notices indicated that published material could include the following:
| Information | Status in the early official account |
|---|---|
| Names and dates of birth | Reported as potentially present in the published files. |
| NHS numbers or other patient identifiers | Reported as potentially present. |
| Test names, descriptions or codes | Identified as a possible category of exposed information. |
| Numerical results, such as blood-sugar values | Possible in some circumstances according to NHS guidance, but not a blanket confirmation that all results were published. |
| Complete LIMS containing test requests and results | Not initially confirmed as published; NHS England said there was no evidence of that release at the 24 June assessment. |
| Business and administrative information | Reported as part of the material claimed to have been released. |
These qualifications matter. Publication on a criminal leak site establishes that attackers posted files, not that every file is authentic, complete or accessible to the public. Do not search those sites or download copies: doing so can expose patients further and may spread stolen information.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Who was responsible?
The Qilin ransomware group claimed responsibility, and contemporaneous reporting and official statements referred to the group in connection with the attack. “Russian-speaking ransomware group” or “group identified as Qilin” is more precise than saying that the Russian state carried out the incident. There is no basis in the cited official statements to describe Qilin as state-sponsored.
How patient care was disrupted
Pathology is embedded in routine and emergency care. Hospitals rely on it for blood grouping and crossmatching, pre-operative checks, cancer and specialist diagnostics, emergency decisions and electronic delivery of results into clinical records. When Synnovis systems were unavailable or slowed, staff had to prioritise urgent tests, send samples elsewhere and work on paper or other manual processes.
Rank #3
- During the first week, more than 800 planned operations and 700 outpatient appointments across the two most affected trusts had to be rearranged, according to an NHS England London update.
- Later NHS summaries said the incident disrupted more than 11,000 outpatient and elective-procedure appointments, with the greatest effect in south-east London.
- Blood testing and transfusion-related work faced additional pressure because grouping and crossmatching require reliable laboratory processing.
The clinical impact was therefore separate from the later data publication: services were disrupted on 3 June, while the alleged leak was reported weeks afterward.
What officials knew—and what remained unresolved
At the first public stages, the evidence supported three different levels of certainty:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Confirmed: Synnovis was attacked; pathology services were disrupted; Qilin published data claiming it came from Synnovis.
- Confirmed by Synnovis in the 24 June update: some of the published data had been stolen from Synnovis systems.
- Still being verified at that point: whether the core LIMS containing patient test requests and results had been published, and the exact patients and records involved.
NHS England’s public questions and answers explain that potentially affected information could include identifiers, test names or codes and, in some circumstances, results or numerical values. That is a statement of possible categories, not a declaration that every patient’s complete medical history appeared online.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What patients and staff should do
- Keep using NHS care. Attend appointments unless your hospital or clinic tells you otherwise. Seek medical help as normal if you are worried about your health.
- Do not contact a hospital solely to ask whether your data was involved. Individual services may not yet hold the forensic information needed to answer. Follow updates through the NHS England incident hub and official provider communications.
- Treat unexpected messages as possible phishing. Attackers or fraudsters may use a real name, NHS number, appointment detail or test reference to appear convincing.
- Never disclose passwords, banking details or identity documents in response to an unsolicited email, text or call. Verify a contact using a phone number or web address obtained independently from an official NHS, hospital or Synnovis site.
- Report suspicious messages through the relevant UK reporting channels. If you are concerned about how your personal data was handled or about your privacy rights, consult the Information Commissioner’s Office statement.
Why this incident matters beyond south-east London
Diagnostic data is unusually sensitive: it can reveal a person’s identity, condition, treatment pathway or urgent clinical concern. The incident also shows how a ransomware attack on a specialist supplier can interrupt several hospitals, GP practices and clinics at once. Outsourcing did not by itself cause the attack, but concentration of essential laboratory services creates a single point of failure that health systems must plan around.
Best Value
For the most current position, use NHS England’s incident hub and Synnovis’ cyberattack information centre. The safest summary remains: data linked to Synnovis was published, while the scope of any patient test-result exposure required—and initially continued to require—official verification.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems
