London Hospitals Held To Ransom

Seven London NHS hospital trusts have been forced to cancel all non-emergency operations and blood tests following a major cyber attack. 

This has meant that operations are being cancelled and emergency patients being diverted elsewhere. It applies to hospitals partnered with Synnovis, a provider of pathology services to a least seven hospitals run by the NHS in the London area have been attacked.  

Synnovis covers Guy’s Hospital, which runs the Evelina London Children’s Hospital, as well as Harefield Hospital, King’s College Hospital, Princess Royal University Hospital, Royal Brompton Hospital and St Thomas’ Hospital as well as GP services across South London. The incident has had a "major impact" on the delivery of services, especially blood transfusions and test results. Non-hospital GP services across large parts of London  have also been affected. 

According to reports, the attack began on Monday 3rd June when a number of Hospital departments could not connect to a main server. As a consequence, some procedures have been cancelled or have been redirected to other NHS providers as the hospitals try to establish what work can be carried out safely.  However the NHS has said that emergency care continued to be available. 

NHS officials said they are working with the National Cyber Security Centre to understand the impact of the attack, while Synnovis said it has been reported to law enforcement and the Information Commissioner

A spokesperson for NHS England London said in a statement “On Monday 3 June Synnovis, a provider of lab services, was the victim of a ransomware cyber attack...  This is having a significant impact on the delivery of services at Guy’s and St Thomas’, King’s College Hospital NHS Foundation Trusts and primary care services in south east London and we apologise for the inconvenience this is causing to patients and their families." 

“We are working urgently to fully understand the impact of the incident with the support of the government’s National Cyber Security Centre and our Cyber Operations team.” A spokesperson from Synnovis said the company had sent in a "taskforce of IT experts" to "fully assess" the impact. 

In a new development, the group of cyber criminals known as Qilin are thought to be behind the  cyber attack. Qilin is understood to be a Russian hacking gang that runs a ransomware-as-a-service model. They operate using websites on the Dark Web and are suspected of previously targeting  the Big Issue publishing group.

According to the experts at Check Point, Qilin is a Russian-affiliated cyberattack group that operates on a ransomware-as-a-service (RaaS) model and has been active since 2022. This group is known for using Rust and Go programming languages to create its versatile ransomware and maintains a shame site to publish the identity and data stolen from its victims, conducting double-extortion tactics. The group, also known as ‘Agenda’, launched its operations in August 2022 and “rebranded” to Qilin in 2023.

According to Ciaran Martin, the former Chief Executive of the National Cyber Security Centre, Qilin has a two-year history of attacking organisations across the world. Martin claims Qilin’s attack on Synnovis is “more serious”  as it has led to systems not working, adding that this is “really one of the more serious that we’ve seen in this country”.  

In other comment, Alan Stephenson-Brown the CEO at Evolve Group describes the attack as ".. a stark reminder of the importance of stringent cybersecurity measures in the healthcare industry. The value of personal identifiable information held by the NHS cannot be underestimated, or how much of a target it makes the sector to actors who deal in such data on the dark web..."

"While it’s been reported that the health board in this case is urging the public to be alert for any attempts to access their work and personal data, I urge this action to start at the top, and for healthcare bosses to seriously appraise the systems they have in place to identify any potential vulnerabilities... While ensuring contingency planning is in place is vital, healthcare providers should urgently take preventative measures to protect patient data." he said.

Underinvestment in IT can leave systems vulnerable to attack, however, the risk to patient health means hospitals are motivated to restore services as quickly as possible, regardless of the cost. 

While British government policy is not to pay hackers, healthcare services are a priority targets internationally for ransomware gangs, as demonstrated in other recent attacks on the Britsh NHS as well as national healthcare services in Ireland and Spain

NHS England   |   BBC   |   Independent   |   Guardian   |   Computer Weekly   |   The Record   |   News&Star    |

Check Point Software

Image: Ideogram

You Might Also Read:

Stolen NHS Data Published On The Dark Web:

___________________________________________________________________________________________

If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« You’ve Got Mail
Hackers Target Healthcare »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Backup Systems

Backup Systems

Backup Systems is a leading backup and disaster recovery systems provider across the UK.

Device Authority

Device Authority

Device Authority specialises in security automation for the Internet of Things (IoT).

Huntsman Security

Huntsman Security

Huntsman Security provides technology to enable real-time security monitoring and immediate visibility of advanced threats and compliance issues.

Decision Group

Decision Group

Decision Group are a Total Solution Supplier offering Network Forensics and Lawful Interception tools.

SecuPi

SecuPi

SecuPi delivers data-centric security with data-flow discovery, real-time monitoring, behavior analytics, and protection across web and enterprise applications and big data environments.

Snyk

Snyk

Snyk is the leader in developer security. We empower the world’s developers to build secure applications and equip security teams to meet the demands of the digital world.

Telecommunications Industry Association (TIA)

Telecommunications Industry Association (TIA)

TIA works to secure trust in networks by advocating public policy positions on the security of ICT equipment and services related to critical infrastructure, supply chain and information sharing.

SKKU Security Lab (seclab)

SKKU Security Lab (seclab)

SKKU Security Lab supports research and education in information security engineering. The lab is a part of the College of Software, Sungkyunkwan University.

NAVEX Global

NAVEX Global

NAVEX Global’s compliance management system consolidates your entire GRC program onto a scalable cloud-based platform.

Automox

Automox

Remediate vulnerabilities 30X faster than the industry norm – and dramatically reduce your risk with simple, fast, and cloud-native endpoint hardening from Automox.

Axitea

Axitea

Axitea designs, implements and develops the solutions best suited to its customers’ needs and their physical and cyber security requirements.

Tugboat Logic

Tugboat Logic

Tugboat Logic was created to address the skills and expertise gap in the security and compliance industry. Our goal is to simplify and automate information security management for every enterprise.

Wickr

Wickr

Wickr's mission is to secure the world's most critical communications. Wickr provides the highest standard of encryption trusted by millions worldwide.

Fireblocks

Fireblocks

Fireblocks is a digital asset security platform that helps financial institutions protect digital assets from theft or hackers.

Patriot Consulting Technology Group

Patriot Consulting Technology Group

Patriot Consulting's mission is to help our clients manage cybersecurity risk through secure deployments of Microsoft 365.

CyberSalus

CyberSalus

CyberSalus is a pioneering cyber tech services company dedicated to protecting the digital integrity of healthcare organizations.