Loading story…
German police arrested a 28-year-old Russian man accused of belonging to the cybercrime gang linked to the 2024 attack on Synnovis, a blood-testing company serving the NHS. The attack disrupted pathology services across several London hospitals and reportedly contributed to a patient’s death. The suspect’s alleged involvement has not been established by a conviction.
The supplied reports do not identify the suspect or the gang, or detail the circumstances of the reported death. The arrest highlights the continuing investigation into an attack whose effects extended beyond the contractor to hospital operations and patient care, underscoring the potentially severe consequences of disruption at critical healthcare suppliers.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
Blood-testing firm and NHS contractor Synnovis was targeted by a cyberattack that disrupted pathology services across several London hospitals.
German police arrested a 28-year-old Russian man accused of belonging to the cybercrime gang responsible for the Synnovis attack. The supplied reports do not name the suspect or establish his alleged involvement as a conviction.
The report states that the cyberattack on Synnovis contributed to a patient’s death. The supplied content does not specify when the death occurred.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Bedfordshire Hospitals NHS Foundation Trust said data relating to **32,927 patients** was identified in material stolen during the **Synnovis ransomware attack**, confirming that the incident extended beyond service disruption into a significant patient data breach. The compromised information was linked to pathology-related files dating from **2011 to 2020** and may include personal details and diagnostic test results. The trust issued a public notification tied to the Synnovis cyber incident and began informing affected individuals after determining that their records were present in data later published on dark web sites. The organizations involved said notification was delayed because the stolen material was fragmented across unstructured administrative pathology files, requiring lengthy forensic analysis to attribute ownership and assess impact. Security experts said the case highlights the long-tail risk of third-party attacks in NHS supply chains, warning that even partial or disjointed healthcare records can be combined by threat actors for phishing, fraud, and other identity-related abuse.
Jun 29, 2026
Synnovis, a British pathology laboratory services firm, has begun notifying UK healthcare providers that patient data may have been compromised in a ransomware attack that occurred in June 2024. The attack disrupted laboratory services and caused blood shortages, significantly impacting patient care for several months. Following a complex forensic investigation, Synnovis determined that cybercriminals stole data in a hasty and disorganized manner from a working drive, resulting in fragmented and unstructured data exfiltration. The company stated that none of the stolen data originated from its primary laboratory database. Under UK data protection law, Synnovis is responsible for informing healthcare providers, who must then notify affected patients if necessary. The notification process follows more than a year of investigation to identify the scope and nature of the compromised data. Synnovis emphasized the challenges in analyzing the stolen data due to its random and untargeted extraction during the cyberattack.
Jun 29, 2026
Nottingham University Hospitals NHS Trust apologized after a public inquiry found survivors of the 2023 Nottingham attacks were not properly included when the trust investigated unauthorized access to their medical records. The inquiry said staff inappropriately viewed victims’ records without authorization, and a 2025 internal investigation uncovered broader misuse of sensitive patient information. The trust said its response initially focused too narrowly on bereaved families, while disciplinary action resulted in 11 employees being dismissed and several others receiving written warnings for serious data protection violations. Separately, the fallout from the 2024 Synnovis ransomware attack linked to the **Qilin** gang continues to widen across the NHS, with Mid and South Essex NHS Foundation Trust confirming about **2,380** specialist diagnostic testing records were affected after Bedfordshire Hospitals NHS Foundation Trust disclosed nearly **33,000** impacted records. The attack disrupted pathology services across south east London, causing canceled appointments, delayed operations, and blood testing and transfusion problems, while stolen patient data was later published online after extortion failed. NHS organizations are still identifying affected patients, and King’s College Hospital NHS Foundation Trust has said service delays caused by the outage contributed to a patient’s death.
Jun 29, 2026