AlphaMED Resources · https://alphamedicine.uk/Resources/synnovis

Synnovis NHS cyber attack

In June 2024 criminals locked the computer systems of the lab that runs blood tests for two of London's biggest hospital trusts. More than 10,000 appointments were postponed, and a long wait for a blood test result contributed to one patient's death.

Updated 12 October 2026 (2 minute read)

AutonomyNon maleficenceJustice
  1. Ransomware locks the Synnovis lab systems
  2. 400GB of stolen data published
  3. Hospital confirms the delays contributed to a death
  4. Government plans a ban on ransom payments
  5. Affected patients finally identified

Summary

  • Synnovis runs blood testing for King's College Hospital, Guy's and St Thomas' and GP surgeries across south east London.
  • On 3 June 2024 a criminal group called Qilin broke into its systems, encrypted them so that nobody could use them, and demanded money to unlock them. This kind of attack is called ransomware.
  • Without the lab, hospitals could not get test results or match blood for transfusions.
  • NHS England counted 10,152 outpatient appointments and 1,710 operations postponed.
  • Synnovis refused to pay. On 20 June the group published about 400GB of stolen data online.
Blood samples being loaded into a laboratory analyser

Dig deeper

  • In June 2025 King's College Hospital confirmed that a patient had died unexpectedly during the attack. A long wait for a blood test result was one of the contributing factors.
  • The attack cost Synnovis an estimated £32.7m in 2024.
  • Working out whose data had been stolen took until November 2025, 17 months after the attack.
  • In July 2025 the government said it would ban public bodies, including the NHS, from paying ransoms.
  • A new law on cyber security for companies that supply public services is still going through Parliament.
  • The NHS had been through this before. In 2017 an attack called WannaCry disrupted about a third of NHS trusts in England.

Ethical issues

PrincipleHow it applies here
AutonomyPatients decide who sees their medical information, and they share it on the understanding that it stays private. Here it was held by a supplier most patients had never heard of, and it ended up on the internet.
Non maleficenceNobody was physically attacked, yet operations were cancelled and a late blood result contributed to a death. A hospital that cannot run its computers cannot treat patients safely.
JusticePaying a ransom might help the patients waiting today. It also funds the next attack on another hospital, which is why the government has chosen a ban for public bodies.

Interview questions

  • What happened in the Synnovis cyber attack?
  • Systems are down and patients may die while you wait. Should a hospital ever pay the ransom?
  • A patient asks whether their test results were in the stolen data, and you do not know. What do you say?
  • Why is patient confidentiality so important in medicine?
  • The NHS wants to move from paper to digital records. What are the risks and benefits?
  • Who is responsible when a private supplier to the NHS is attacked?
  • How could a hospital prepare for losing its computer systems?

Sources

  1. NHS Englandengland.nhs.uk/…/latest-media-statement-on-synnovis-cyber-attack
  2. The Recordtherecord.media/…/ransomware-attack-contributed-patient-death-uk-nhs
  3. Digital Healthdigitalhealth.net/…/cyber-attack-cost-synnovis-estimated-32-7m-in-2024
  4. King's College Hospitalkch.nhs.uk/…/synnovis-cyber-attack-update
  5. National Audit Officenao.org.uk/…/investigation-wannacry-cyber-attack-and-the-nhs

Photo: Goleisureintl, CC BY 4.0, via Wikimedia Commons, colour altered.

Practise answering these with a mentor

Our interview preparation has you answer questions like these out loud, with feedback on each answer.

See interview preparation Book a free consultation

alphamedicine.uk/Services · alphamedicine.uk/Contact

Related

Infected blood scandal AutonomyNon maleficenceJustice More than 30,000 NHS patients caught HIV or hepatitis C from their treatment in the 1970s and 1980s. A public inquiry reported in 2024, compensation payments began that December, and no one has been prosecuted. Resident doctor strikes Non maleficenceJustice Doctors in training in England first went on strike over pay in March 2023. By the time they accepted a deal, by 53% to 47%, the argument was as much about a shortage of jobs. Edenfield Centre abuse scandal AutonomyNon maleficenceJustice The Edenfield Centre is a secure mental health unit in Manchester whose patients are not free to leave. In 2022 a reporter working there undercover filmed staff mocking and mistreating them.

More NHS hot topics, medical ethics case studies and medical school interview questions are in AlphaMED Resources, which we add to and update through the application cycle.