Glossary term
Ransomware
Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.
Read more
Significant cyber incident
Synnovis NHS pathology ransomware attack
On 3 June 2024 Synnovis, the pathology (blood test) provider for several London NHS hospitals, was hit by a ransomware attack that affected almost all of its IT systems.
In short
On 3 June 2024 Synnovis, the pathology (blood test) provider for several London NHS hospitals, was hit by a ransomware attack that affected almost all of its IT systems. Tests were cut back and thousands of appointments and operations in south east London were postponed. On 20 June a criminal group published data it had stolen. Synnovis restored its services by December 2024 and finished its review of the stolen data in November 2025.
What happened
On Monday 3 June 2024 Synnovis was hit by a ransomware attack. Synnovis processes blood and other tests for NHS hospitals and GP services, mostly in south east London. It is owned by Guy’s and St Thomas’ NHS Foundation Trust, King’s College Hospital NHS Foundation Trust and SYNLAB. On 4 June it said the attack had affected all of its IT systems and interrupted many pathology services.
With its systems down, Synnovis could process far fewer samples and kept the capacity for urgent work. Many steps went back to paper. NHS England said the NHS could not use some systems that are essential to run blood tests in south-east London. The two partner trusts and other local providers were affected, and hospitals had to use O-type blood because they could not cross-match blood for transfusions.
On 20 June 2024 a cyber criminal group that claimed responsibility published data online. Synnovis confirmed on 24 June that the data was stolen from its systems. It came from an administrative working drive, not from the main laboratory database. Synnovis restored almost all services by December 2024 and, in November 2025, said it had finished its review of the stolen data and had begun telling the organizations whose data was in it.
Timeline
-
3 June 2024
Synnovis is hit by a ransomware cyberattack.
-
4 June 2024
Synnovis says all its IT systems are affected and some activity is canceled or redirected.
-
14 June 2024
NHS England London starts weekly management data. For 3 to 9 June, more than 800 planned operations and 700 outpatient appointments at the two most affected trusts needed to be rearranged.
-
17 June 2024
Synnovis says capacity is much reduced and kept for urgent work; analyzers are back online.
-
20 June 2024
A cyber criminal group that claims the attack publishes data online.
-
21 June 2024
NHS England and the NCSC publish statements; the NCA and NCSC start verifying the data.
-
24 June 2024
Synnovis confirms the data was stolen from its systems; no evidence the laboratory database was posted.
-
1 July 2024
Synnovis says almost all its IT systems were affected and many processes use paper.
-
25 July 2024
Synnovis says it is rebuilding over 60 interconnected IT systems; core tests return at King's and Princess Royal University Hospitals.
-
30 July 2024
Synnovis announces it has an injunction limiting use of the stolen data.
-
19 September 2024
The final group of GP services moves back to Synnovis.
-
4 October 2024
NHS England London reports 10,152 outpatient appointments and 1,710 elective procedures postponed and says almost all services are back.
-
18 December 2024
Synnovis says almost all pre-attack services are available again.
-
10 November 2025
Synnovis says its review of the stolen data is complete and starts notifying affected organizations, to finish by 21 November.
How the attack worked
What the sources say
Synnovis described the event as a ransomware attack. On 25 July 2024 it said it could not give details of the method of attack because the investigation was sensitive. None of the official pages opened say how the attackers got in or which tools they used, so this page does not guess.
Why a lab provider matters
Synnovis said almost all its IT systems were affected, from the analyzers that identify and process samples to sending results. Work went back to paper. Because several hospitals and GP practices depend on one provider, one attack reduced testing capacity across the area.
The stolen data
The criminals published data on 20 June 2024. NHS England says the files came from Synnovis’ administrative working drive, which supported corporate and business support activity. Synnovis found no evidence that the laboratory database, which holds most test requests and results, was published. Synnovis later said the data was unstructured, incomplete and fragmented, and that this made the review take over a year.
Who says who was behind it
Who attributed it, and how firm it is
No public attribution by an official source. Synnovis, NHS England and the NCSC (statements of June 2024) refer to "a cyber criminal group" that claimed responsibility and published data, and none of the official pages opened names the group. The NCSC said on 21 June 2024 that investigations were ongoing. Media reports have named a ransomware group, but they were not checked against two major outlets for this page, so no group is named here.
Impact
Services: Synnovis said capacity to process samples was significantly reduced and kept for urgent work (17 June 2024). Almost all services available before the attack were again available by 18 December 2024, and NHS England says services were fully restored by December 2024.
Appointments and operations: for 3 to 9 June 2024, more than 800 planned operations and 700 outpatient appointments at King's College Hospital and Guy's and St Thomas' needed to be rearranged (NHS England London, 14 June 2024). By 4 October 2024 NHS England London counted 10,152 acute outpatient appointments and 1,710 elective procedures postponed at those two trusts. NHS England's later Q&A speaks of delays to over 11,000 outpatient and elective procedure appointments. Sources differ in scope: the first counts the two trusts, the second counts the whole incident.
Other organizations: Oxleas, Lewisham and Greenwich NHS Trust, Bromley Healthcare and primary care in south east London were also affected (NHS England London, 4 October 2024).
Blood: the affected trusts could not cross-match blood, used O-type blood, and this contributed to a national shortage of O-type blood. NHS Blood and Transplant asked O positive and O negative donors to give blood.
Data: stolen files were published. NHS England says an initial analysis found names, NHS numbers and test codes. Content varies by person and by organization; for one trust no actual test results were found. Cancellations were limited to south east London, but the stolen data may relate to any Synnovis service user across England.
Not stated in the sources opened: cost of the incident, ransom demand, number of people whose data was exposed.
Government and regulator response
- 4 June 2024: Synnovis said it was reporting the incident to law enforcement and the Information Commissioner and working with the NCSC and NHS England’s Cyber Operations Team. A taskforce of IT experts from Synnovis and the NHS was assessing the impact.
- June 2024: Non-urgent blood tests were redirected to other pathology labs. Mutual aid was rolled out across all six south east London boroughs by 1 July. NHS England London published weekly impact figures from 14 June, and a helpline was set up.
- 21 and 24 June 2024: The NCSC and NHS England issued statements. The NCA and NCSC worked to verify the published data. The NCSC pointed people to guidance on protecting themselves after a data breach.
- 30 July 2024: Synnovis said it had secured an injunction to limit downloading, sharing or misuse of the stolen data.
- September to December 2024: GP services moved back to Synnovis, blood transfusion laboratory systems were reconnected, and almost all pre-attack services were back by 18 December.
- 10 November 2025: Synnovis said it had completed the forensic review and started notifying affected organizations. Under UK data protection law each organization decides on its own notifications. NHS England and NHS South East London said the incident no longer disrupted appointments, and trusts such as King’s College Hospital began reviewing their data. North Cumbria Integrated Care reported the matter to the ICO.
The Information Commissioner’s Office: NHS England says Synnovis reported the incident to the ICO and has been in regular contact. No ICO decision or penalty was found in the official pages opened. NHS England’s published review of lessons was also not found.
Lessons
-
One supplier can stall many hospitals
Synnovis is shared by several trusts and GP services. When its systems failed, testing capacity fell across south east London. Map which suppliers your critical services depend on.
-
Plan for manual working
Synnovis processes went back to paper, which cut capacity. Practise downtime procedures before an incident.
-
Recovery is slow and phased
Rebuilding over 60 systems took until December 2024. Plan recovery by clinical or business criticality.
-
Mutual aid helps
Other labs and the wider SYNLAB network took on work. Agree backup capacity in advance.
-
Stolen data can take over a year to understand
The files were unstructured, incomplete and fragmented, so the review ended in November 2025. Keep data inventories so you can say what you hold.
-
Keep admin drives clean of patient data
The published files came from an administrative working drive and still held names, NHS numbers and test codes. Limit personal data on general drives.
What to check in your own organization
-
Supplier map
List every outside provider your critical services need (labs, imaging, IT) and who covers for them if they fail.
-
Downtime plan
Test paper-based or manual working for your most critical processes and how long you can sustain it.
-
Backup capacity
Check you have agreed mutual-aid or backup providers for urgent work.
-
Data on shared drives
Search administrative and shared drives for personal data such as names, ID numbers and test codes.
-
Restore order
Write down the order in which systems come back, based on how critical each is.
-
Notification duties
Know who decides on regulator and individual notices when a supplier holds your data, and how fast the supplier must tell you.
-
Staff and public messages
Prepare plain messages that warn people about scam calls and emails after a data breach, using NCSC advice.
Where it happened
Questions
What happened to Synnovis?
On 3 June 2024 it was hit by a ransomware attack that affected almost all of its IT systems and cut its ability to process tests.
Which hospitals were affected most?
King's College Hospital NHS Foundation Trust and Guy's and St Thomas' NHS Foundation Trust, according to NHS England London. Other local trusts and GP services were also affected.
How many appointments were postponed?
By 4 October 2024 NHS England London counted 10,152 outpatient appointments and 1,710 elective procedures at the two most affected trusts. NHS England's later Q&A says over 11,000 appointments in total.
Was data published?
Yes. A group that claimed the attack published data on 20 June 2024. Synnovis confirmed it was stolen from its systems. It came from an administrative drive, not the main lab database.
Who was behind it?
No official source opened names the group. Official statements say "a cyber criminal group".
When were services back?
Almost all pre-attack services were available again by 18 December 2024.
Will patients be contacted?
Synnovis does not contact patients. If needed, the NHS organization holding your data will do so.
Sources
- Cyberattack Information Centre (Synnovis statements, June 2024 to November 2025) SYNLAB UK and Ireland / Synnovis
- NCSC statement following reports of a Synnovis data breach (21 June 2024) National Cyber Security Centre
- Synnovis cyber attack, statement from NHS England (21 June 2024, archived copy) NHS England
- Synnovis cyber attack, statement from NHS England (24 June 2024, archived copy) NHS England
- Update on cyber incident clinical impact in south east london, 14 June 2024 (archived copy) NHS England London
- Almost all services back on track after cyber attack hit south east London (4 October 2024, archived copy) NHS England London
- Synnovis cyber incident, public questions and answers (archived copy) NHS England
- Synnovis cyber incident (archived copy) NHS England
- Synnovis cyberattack update, 10 November 2025 NHS South East London
- Synnovis cyber-attack update, 10 November 2025 King's College Hospital NHS Foundation Trust
- Data Incident, Synnovis (31 December 2025) North Cumbria Integrated Care NHS Foundation Trust
- Qilin, Software S1242 (ransomware as a service, active since at least 2022) MITRE ATT&CK
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.