Synnovis admits to data breach after Qilin ransomware gang releases 400GB of stolen data

London-based pathology services provider Synnovis has admitted that threat actors took data from its systems in a security incident that impacted several NHS hospitals in London.

 

On June 3, Synnovis said it was a victim of a ransomware attack that affected all IT systems. The ransomware attack affected several NHS hospitals, including Guy’s and St Thomas’ NHS Foundation Trust, King’s College Hospital NHS Foundation Trust, and other primary care providers across south east London.

 

Ciaran Martin, the former CEO of the National Cyber Security Centre, said that the Qilin ransomware group was behind the cyber attack on Synnovis. In an interview with BBC Radio 4, Martin said, “We believe it is a Russian group of cyber criminals who call themselves Qilin.

 

“They’re simply looking for money. It’s unlikely they would have known that they would have caused such serious primary healthcare disruption when they set out to attack the company,” he added.

 

The Qilin ransomware group claimed responsibility for the cyber attack on Synnovis and has now released 394.1 GB of confidential information stolen from the company. According to Sky News, the leaked data includes names, dates of birth, NHS numbers and descriptions of blood tests.

 

Acknowledging the ransomware group’s claims, Synnovis said that the leaked data indeed was taken from its network. While the company is in the process of analysing the published data, it said, “Our administrative working drive has been posted in partial and fragmented form. This will contain some fragments of patient identifiable data.”

 

“There was no evidence that the Laboratory Information Management Systems (the software that supports laboratory operations) databases had been posted. These are the main systems holding the patient test requests and results.

 

“The area where we store payroll information has not been published, but more needs to be done to review other data that has been published relating to our employees,” the pathology provider said.

 

"We and the technical experts who are supporting us are working as fast as we can to try to be able to confirm more details and appreciate that waiting will potentially cause people some concern. We will keep our service users, employees and partners updated as the investigation progresses," it added.