mythsthe wider recordSynnovis2024healthcare and pathology services

everyone assumed:

a cyberattack is an IT problem, not a safety problem

what was actually true:

When the systems that carry a clinical result go down, the consequence does not stay inside the data centre.

how it happened

  1. whoQilinreported: credentials
  2. the gapno 2FAper the trusts' own CDIO
  3. thenpathology offlineblood tests delayed
  4. the result1,700+ operations postponed900,000+ people's data
the gap that let it happen the result

what everyone assumed

Security incidents tend to be filed under technology, because that is where they begin and that is the team that responds. The reasonable belief is that an attack damages systems and data, and that clinical care, which lives in the hands of people, carries on alongside it. Continuity planning often reflects this, treating an outage as something to route around rather than something that can reach a patient.

what happened

Here the stretch was days that behaved like weeks. On 3 June 2024 the Qilin group’s ransomware reached Synnovis, the pathology partner to two major NHS trusts. Initial access, by the pattern reported for attacks of this kind, ran through credentials rather than a dramatic exploit, and the trusts’ own chief digital information officer later said publicly that the breach might not have happened had two-factor authentication been in place on remote access. With pathology offline, blood typing slowed, hospitals issued an appeal for O-type donors to protect their reserves, and clinical teams worked from paper and phone calls. Each delayed result was a small wait. The small waits accumulated inside real care.

step by step

  1. remote access without two-factorThe trusts' own digital chief later said this might have prevented it.the assumption breaks here
  2. 3 June 2024Qilin ransomware hits the pathology partnerOf two major NHS trusts.
  3. blood testing slowsAn appeal for O-type donors; teams work from paper and phone.
  4. 10,000 plus appointments, 1,700 plus operations900,000 plus people's data exposed. Delays named as one factor in a patient's death.

how it surfaced

More than 10,000 appointments were disrupted and over 1,700 operations postponed across King’s College Hospital and Guy’s and St Thomas’. The personal data of more than 900,000 people was later confirmed exposed. In June 2025, King’s College Hospital NHS Foundation Trust confirmed that delays in obtaining blood test results during the attack were among a number of contributing factors in the death of a patient. That sentence is the one that retires the assumption, and it should be read exactly as carefully as it was written.

When the systems that carry a clinical result go down, the consequence does not stay inside the data centre.

In a hospital, availability is a form of patient safety, and an attack on the one is an attack on the other.

picture it at a company like yours

The company here is made up. The other two paths are not: they happened, and each links to the story.

your company
a normal dayA key supplier does work you depend on every day, like labs, payroll or logistics.
the gap nobody seesTheir remote access has no two-step login, and you never asked.a password is the only lock
  1. in this story
    the day it mattersRansomware hits the supplier and their service stops.
    what it costs youYour own customers wait, and the harm lands on people who never heard the supplier's name.
  2. or it goes like this
    howLeaked passwords are tried against customer accounts until some open.
    what leavespersonal details of customers and their contactswho ends up with itfraudsters
    it happened23andMe, 2023
  3. or it goes like this
    howAn old password opens a data store that never required a second step.
    what leavesthe whole database in one downloadwho ends up with itan extortion group
    it happenedThe Snowflake wave, 2024

sources

  1. Patient Death Linked to Ransomware Attack on Pathology Services Provider ,
  2. Synnovis 2024 Attack 'Contributing Factor' in Patient Death ,
  3. Patient Death Linked to NHS Cyber-Attack ,
  4. NHS supplier ends probe into ransomware attack that contributed to patient death ,
  5. Synnovis Ransomware Attack: Impact, Victims, Recovery (Huntress) ,

← all myths

your turn

what you can do about it

  1. this week

    Take your single most critical such system and ask two plain questions: every way in is covered by phishing-resistant multi-factor authentication, and if it went dark tomorrow, who downstream would be left waiting and for how long.

    Somewhere in your organisation a system feeds a decision that a person depends on, whether that is a test result, a dispatch, a dose, or a yes or no at a counter. The Synnovis story is not asking you to fear an attacker. It is asking whether your continuity plan knows that an outage can reach a person.

  2. go deeper

  3. if you're not sure where to start

    Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.

    open the checklist →

the letter · every two weeks

one access gap in your inbox, with the fix.

Every issue takes one way access creeps in, shows a real incident where it went wrong, and ends with one thing to check that week. Written for the people who run the tools, without a security team behind them.

  • 1one mechanism, explained plainly
  • 2one real incident, taken apart
  • 3one step you can take on Monday

get the next issue

One email every two weeks. Your address stays here and is never passed to vendors. One click to unsubscribe. Privacy.