Loading story…
A ransomware attack attributed to the Russia-based Qilin gang severely disrupted pathology and clinical services at London hospitals, with officials and media reports identifying the incident as the cause of widespread delays to treatment and diagnostics. Reporting on the fallout said nearly 200 cancer operations were postponed, alongside other surgeries and appointments, after systems supporting blood testing and related services were knocked offline. Qilin was identified in multiple reports as the group behind the intrusion, and it later published stolen NHS data online.
The consequences later escalated beyond operational disruption when a patient's death was confirmed to have been linked to the attack, underscoring the life-threatening impact of ransomware on healthcare delivery. Former NHS National Services Scotland CISO Alastair Mitchelson said such an outcome was tragic but not surprising when systems used for diagnosis and treatment fail at scale. Qilin reportedly expressed regret for the harm while denying responsibility, and claimed the attack was a political protest tied to grievances against the UK government.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
A death was later confirmed following the cyberattack-related disruption to healthcare systems, making the incident one of the clearest examples of ransomware causing fatal real-world harm in medical services. Coverage also noted Qilin had expressed regret for the harm while denying responsibility for the death.
Reporting on the continuing impact said almost 200 cancer operations had been postponed at London hospitals because of the ransomware attack. The disruption highlighted the severe effect on patient care weeks after the initial breach.
Qilin published data stolen in the attack, escalating the incident from operational disruption to confirmed data exposure. The leak increased concerns about patient and healthcare information being compromised.
Within days of the disruption, reporting said Russian cyber criminals were thought to be behind the NHS attack, with the Russia-based ransomware group Qilin identified as responsible. This marked the first public attribution of the incident.
A ransomware attack hit Synnovis, a pathology services provider for several London NHS hospitals and GP practices, causing major disruption to diagnostics and treatment services. The incident affected hospitals including King's College Hospital and Guy's and St Thomas'.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
4 references tracked. Mallory keeps watching after this page renders.
bbc.co.uk
Open sourcecomputerweekly.com
Open sourcetherecord.media
Open sourcetelegraph.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Qilin** ransomware-as-a-service emerged as the most prominent ransomware threat affecting UK organizations in the first half of 2026, with 37 UK victims named on its Tor leak site—more than **DragonForce** and **TheGentlemen**. Reporting says the group averaged seven to nine UK disclosures per month and primarily hit SMEs across construction, manufacturing, legal services, technology, education, and healthcare. The campaign’s impact continued to reverberate from the 2024 **Synnovis** attack, after Bedfordshire Hospitals NHS Foundation Trust disclosed that more than **32,000 patient records** linked to Synnovis tests had been exfiltrated. Researchers and incident trackers also tied Qilin to fresh victim disclosures outside the UK, including **INTERTRUST AUSTRALIA PTY LTD**, a professional services firm in Australia associated with the domain `www.seedoutsourcing.com`. Prior reporting on Qilin’s operations describes a mature affiliate model and an extortion cycle of roughly six weeks from intrusion to public naming, with common tactics including exploitation of VPN gateways and **BYOVD** techniques to disable or evade EDR and antivirus tools. Separate reporting noted **Salford City College** appeared on both Qilin’s and DragonForce’s leak sites within days, raising the possibility of affiliate overlap or multiple compromises.
Aug 5, 2026
Nottingham University Hospitals NHS Trust apologized after a public inquiry found survivors of the 2023 Nottingham attacks were not properly included when the trust investigated unauthorized access to their medical records. The inquiry said staff inappropriately viewed victims’ records without authorization, and a 2025 internal investigation uncovered broader misuse of sensitive patient information. The trust said its response initially focused too narrowly on bereaved families, while disciplinary action resulted in 11 employees being dismissed and several others receiving written warnings for serious data protection violations. Separately, the fallout from the 2024 Synnovis ransomware attack linked to the **Qilin** gang continues to widen across the NHS, with Mid and South Essex NHS Foundation Trust confirming about **2,380** specialist diagnostic testing records were affected after Bedfordshire Hospitals NHS Foundation Trust disclosed nearly **33,000** impacted records. The attack disrupted pathology services across south east London, causing canceled appointments, delayed operations, and blood testing and transfusion problems, while stolen patient data was later published online after extortion failed. NHS organizations are still identifying affected patients, and King’s College Hospital NHS Foundation Trust has said service delays caused by the outage contributed to a patient’s death.
Jun 29, 2026
The **Qilin** ransomware group claimed multiple new victims across the United States, Canada, Austria, and Germany, hitting organizations in manufacturing, professional services, financial services, media, retail, property management, and utilities. Named victims included Community Management Associates, Pointe Property Group, Ceragres, Dienst Pack Systems, Schreiner Trockenbau GmbH, Commercial Furniture Interiors, *The Saturday Evening Post*, Wire Products, Freedom Claims Management, and Service Electric. Several reports described the incidents as both ransomware attacks and associated data breaches, indicating continued emphasis on extortion through stolen data as well as operational disruption. Separate reporting tied Qilin affiliates to active exploitation of Internet-facing VPN and firewall infrastructure, including **Palo Alto GlobalProtect** `CVE-2026-0257` and **Check Point VPN** `CVE-2026-50751`, as part of broader mid-2026 ransomware access campaigns. That activity was reported alongside common post-compromise tradecraft such as Impacket, NTLM relay, Mimikatz, PsExec, RDP, WMI, browser credential theft, and use of WSL for EDR evasion. A weekly ransomware trend report counted Qilin among the most active groups, with **31 claimed victims** during the period, reinforcing its position as a leading extortion threat affecting organizations across sectors and regions.
Aug 10, 2026