Criminal gang behind London hospitals cyberattack lists victim on darknet site

Qilin, the ransomware group behind an attack that has disrupted healthcare across London, has listed the victim organization Synnovis on its darknet extortion site.

The attack earlier this month on Synnovis, a business providing pathology services for hospitals and local clinics in the capital, prompted major disruptions to services, with blood tests in South East London operating at approximately 10% normal capacity.

“Half of this capacity has been ringfenced to support patients in the acute trusts at Guy’s and St Thomas’ NHS Foundation Trust and Kings College Hospital NHS Foundation Trust,” stated the National Health Service (NHS).

The Qilin group has pledged to publish data stolen from Synnovis, although it is not clear what this data is. The NHS states “investigations are continuing to establish any possible impact to data.”

According to NHS London, a total of 814 elective procedures have been postponed as a result of the attack, including 97 cancer treatments. The service added that 18 organs had been diverted for use by other Trusts. Five planned c-sections were also postponed or rescheduled, and more than 860 outpatient appointments were postponed.

Last week, the health service issued an urgent call on Monday for O-type blood donations because the cyberattack meant “hospitals cannot currently match patients’ blood at the same frequency as usual,” meaning they were instead relying on their stocks of universal donor blood.

A critical incident was declared at the affected hospitals. Medical students have been asked to volunteer to work extra-long shifts, up to 12 hours at time, to help the affected hospitals, and warned they “should be prepared for extended periods on their feet.” 

A memo posted on social media warned: “The ripple effect of this extremely serious incident is felt across various hospital, community, and mental health services in our region.”

Dr. Chris Streather, the medical director for NHS London, said the data “shows that NHS teams are working flat out to see as many patients as possible – but there is no doubt the ransomware cyberattack on Synnovis is having a significant impact on services in south east London, with hundreds of appointments and procedures being postponed.

“Having treatment postponed is distressing for patients and their families, and we apologize to all those who have been impacted, and staff will work hard to re-arrange appointments and treatments as quickly as possible,” added Streather.

“While staff are working round the clock to mitigate the impact and Synnovis is working to recover its IT system, we expect disruption to be felt for some time.”