In June 2024, one of our Pathology service providers was hit by a cyber-attack that significantly disrupted their services and resulted in some stolen data being published.

In December 2025, Synnovis let us know that the stolen data included information from our Trust. Our teams have carefully reviewed all information provided by Synnovis to fully understand the implications of the data breach and the specific data affected.

We have contacted affected individuals directly with information on the data that may have been impacted and steps we have taken to protect them. We have also provided guidance on steps individuals can take to protect themselves as well as places to access further help and support.

We apologise for the impact this has had on affected individuals and are working to continue our commitment to safeguard patient data.

Further information on the Synnovis cyber incident can be found here: https://www.england.nhs.uk/synnovis-cyber-incident/

Question

Answer

1. What do Synnovis provide for the Trust?

Synnovis provides pathology services, including blood, urine and specimen testing to a number of healthcare organisations, including the NHS. Based in South-East London, Synnovis is co-owned by Guy’s and St Thomas’ NHS Foundation Trust, King’s College Hospital NHS Foundation Trust and SYNLAB.

For the Trust, Synnovis provides referral testing for a few niche specialised tests which aren’t conducted within the Trust.

2. What happened in the cyber-attack?

On 3 June 2024, Synnovis was the victim of a ransomware cyber-attack, which disrupted Synnovis’ services across the UK and significantly reduced its capacity to process tests. The impact was greatest in South-East London, within Synnovis’ partner trusts and their local boroughs, causing delays to over 11,000 outpatient and elective procedure appointments. Appointment cancellations were confined to South-East London.

3. What action did Synnovis take post-attack?

Synnovis immediately brought in professional specialist support to help manage the incident and dedicated all available resources to restoring services and rebuilding IT infrastructure. This took some time, but services were fully restored by December 2024.

On 20 June 2024, the criminals responsible for the cyber-attack published data files they had stolen in the attack. Urgent steps were taken by Synnovis, working with the National Cyber Security Centre, law enforcement agencies and the NHS to minimise the risks to individuals and their data. Synnovis also obtained a legal injunction to prevent people from using or further publishing the data. Synnovis reported the incident to the Information Commissioner’s Office (ICO) and has been in regular contact with them ever since.

4. Why has it taken Synnovis so long to complete their investigation?

The next stage of the incident was to understand the scope of the data stolen.

Synnovis has had to undertake a complex investigation to understand what data had been stolen. This investigation has taken more than a year to complete because the stolen data was unstructured, incomplete and fragmented. It took a long time to piece together and work out which of its customers the data related to.

5. When did Synnovis tell the Trust its data was potentially affected?

Synnovis contacted the Trust’s Data Protection Officer on the 1 December 2025 with details regarding what data was affected by the attack. They explained that two data files were being made available to Trusts detailing the data that was stolen they described it as ‘Personal Data’ and ‘Poor Quality Data’.

6. What data was affected?

The data files as detailed in question 5 were explained as ‘data’ which Synnovis has determined is processed on behalf of the Trust and can be attributed directly to an individual patient.

 

(a) Personal Information

-      NHS number, hospital number and/ or patient number

-      Patient name

-      Patient date of birth

-      Other personal data including demographic details and diagnostic test request information

Synnovis advised the Trust that the compromised data did not include any diagnostic test result data attributable to patients.

 

(b)   Poor Quality Data:

This is data which Synnovis determined is processed on behalf of the Trust but couldn’t conclusively link to a particular patient of the Trust. This is because the individual data points were of such poor quality that the investigation was unable to conclusively attribute this data to a patient.

However, this data did contain a name and date of birth which the Trust was then able to attribute to a patient by using Trust systems.

7. What steps were taken by the Trust to gain access to the data described in question 5?

The Trust’s Data Protection Officer (DPO) gained access to the data on 12 December 2025 and was immediately reviewed by the DPO and Cyber Security Lead. Once confirmation of the data was received by Synnovis the DPO received confirmation by the Trust Senior Information Risk Officer (SIRO) to notify the ICO of the breach. The breach was logged on the Trusts internal incident reporting system and then reported to the ICO on 15 December 2025. The ICO acknowledged receipt on 16 December 2025.

8. What steps were taken once the incident was reported to the Information
Commissioner’s Officer (ICO)?

The data files were shared with the Trust pathology teams for them to interpret the data and link to data that was held in the Trust pathology systems. Template notification letters were shared with the Trust by Synnovis and have been tailored for distribution to affected patients. The Trust Audit Committee were also notified of the incident for assurance purposes.

9. Are there any other details about the incident that need to be shared?

Synnovis provided the following detail to the Trust in relation to the incident:

  • The clear format of the Personal Data and Poor Quality Data now available to Controllers bears little resemblance to the unstructured, incomplete and fragmented nature of the compromised dataset which has taken a large team of forensic experts and data specialists over 12 months to piece together.
  • The compromised data was extremely difficult to download given the transient and unstable nature of the server and storage infrastructure relied upon by the cyber criminals (noting that such infrastructure is often utilised by adversaries in an attempt to evade the attention of law enforcement).
  • There is no single technological solution capable of digesting the stolen data into comprehensible outputs linked to individual patients and applicable Controllers. Industry standard tools used across comparable attacks were inadequate.
  • Without the forensic expertise and specialist insight into the compromised data which Synnovis has employed, we consider that the ability of any adversary to misuse it would be very limited.
  • The compromised data does not include any diagnostic test results attributable to patients for whom your organisation(s) acts as Controller.
  • The cyber criminal responsible for this attack has published stolen data relating to over 300 victim organisations since the incident. Its activity is not considered to be specifically targeted toward Synnovis, nor any affected Controller (as evidenced by the unstructured and fragmented nature of the compromised data described above).
  • There is no evidence that the cyber criminal’s interest in Synnovis or the compromised data is ongoing. Nor is there any evidence of misuse of the compromised data against any individual in over 12 months.
  •  On 30 July 2024, Synnovis obtained an injunction to protect patients impacted by the incident by preventing third parties from accessing, holding, publishing, communicating or misusing the data. Synnovis has successfully taken legal action through the injunction since it was originally granted and will not hesitate to further rely upon it as necessary.