Patient Death Linked to NHS Cyber-Attack – Source: www.infosecurity-magazine.com

A patient’s death has been officially linked to the 2024 ransomware attack on Synnovis, the pathology services provider for several NHS hospitals in London. 

The cyber-incident caused widespread disruption to diagnostic services, delaying blood test results and leading to significant harm to patient care.

King’s College Hospital NHS Foundation Trust, one of the facilities most affected, recently confirmed that the patient “died unexpectedly” during the cyber-attack.

“As is standard practice when this happens, we undertook a detailed review of their care,” a spokesperson for the trust told Infosecurity.

“The patient safety incident investigation identified several contributing factors that led to the patient’s death. This included a long wait for a blood test result due to the cyber-attack impacting pathology services at the time. We have met with the patient’s family and shared the findings of the safety investigation with them.”

Synnovis was targeted on June 3 2024, by Qilin, a Russian cybercriminal group. The attack brought pathology and blood testing across multiple NHS trusts and GP practices to a halt. It disrupted more than 10,000 appointments and led to the postponement of 1710 operations at King’s College and Guy’s and St Thomas’ NHS Foundation Trusts.

Impact of the Synnovis Attack

The scale of disruption was substantial, particularly across south-east London’s healthcare system. Key figures include:

• 10,152 outpatient appointments disrupted

• 1710 elective procedures postponed

• 1100 cancer treatments delayed

• 170 cases of patient harm recorded

• 2 cases classified as severe, involving permanent damage or life-threatening delays

Read more on NHS cybersecurity and patient safety failures: National Records of Scotland Data Breached in NHS Cyber-Attack

According to NHS data, nearly 600 patient safety incidents were linked to the attack. Initial reports recorded no serious harm, but revised figures published in 2025 included two cases of severe harm and more than 120 low-harm incidents.

Synnovis CEO, Mark Dollar, responded to the confirmed fatality, saying, “We are deeply saddened to hear that last year’s criminal cyber-attack has been identified as one of the contributing factors that led to this patient’s death. Our hearts go out to the family involved.”

New Measures to Strengthen Cybersecurity

In response to the growing cyber-threat, NHS England and the Department of Health and Social Care have urged all suppliers to adopt a new cybersecurity charter.

The guidance asks vendors to:

• Use multi-factor authentication (MFA)

• Patch known system vulnerabilities

• Maintain support for digital infrastructure

• Keep secure, immutable backups of essential data

The UK government also announced a Cyber Security and Resilience Bill in April 2025, aimed at addressing vulnerabilities in national infrastructure, including healthcare.

Experts have called for an independent review of NHS cybersecurity to ensure patient safety is not compromised in future attacks.

Image credit: William Barton / Shutterstock.com