What we know about the data breach
Synnovis — an NHS pathology provider — confirmed that stolen data includes:
- NHS numbers
- Names and dates of birth
- Some clinical test information that can be linked to individual patients
Because the data was “unstructured, incomplete and fragmented”, investigators say it took over a year to piece together what was taken. The company is now midway through contacting affected NHS organisations and expects this phase to be completed later this month.
- King’s College Hospital
- Guy’s Hospital
- St Thomas’ Hospital
- Royal Brompton Hospital
- Evelina London Children’s Hospital
Hundreds of operations and appointments were cancelled or postponed. Blood transfusion services were also affected, triggering shortages across the capital.
For many, especially those with urgent medical needs, the emotional distress caused by the cancellation of critical procedures was overwhelming. The uncertainty and delays in receiving essential medical care heightened emotional and psychological stress, and patients who had critical surgeries or treatments scheduled were left in limbo. This breach affected not only their physical health, but also their mental well-being.
Data allegedly stolen from Synnovis was later published online by the cybercriminal group Qilin, a ransomware-as-a-service operation linked to more than 300 attacks worldwide. Synnovis has confirmed that it did not pay a ransom, saying it would not financially support criminal activity targeting critical infrastructure.
So, beyond the disruption of medical services, the exposed personal data may have left affected patients vulnerable to fraud, scams, and identity theft.
What this means for patients
If your data was affected, you will hear from your NHS trust, not from Synnovis. Each organisation is carrying out its own assessment to determine which patients are impacted and how serious the risk may be.
For many people, this will be the first time they discover their sensitive medical information has been compromised. If you want to find out more — including whether you could be due compensation — we’ll share everything you need to know.
Join the Claim connects consumers with SRA-regulated lawyers. Visit the claim page to check your eligibility if a claim is open with one of our trusted legal partners. If a group action has not yet been launched, you can register your interest and we’ll keep you informed if a partner firm decides to take a claim forward.
