Qilin RaaS Group Believed to Be Behind Synnovis, NHS Attack

A ransomware attack on a pathology services vendor earlier in the week continues to disrupt patient care, including transplants, blood testing and other services, at multiple NHS hospitals and primary care facilities in London as the firm tries to recover.

See Also: Webinar | Don’t Get Hacked in the Cloud: The Essential Guide to CISOcial Distancing

Russian-speaking cybercriminal gang Qilin is believed to be behind the attack, which is “one of the more serious” such incidents ever seen in England, said Ciaran Martin, former chief executive of the U.K. National Cyber Security Center, during a BBC interview on Wednesday. Martin told the BBC that the criminal group was “looking for money” by targeting Synnovis but that the British government has a policy against paying ransoms.

Synnovis is a partnership between two London-based hospital trusts and SYNLAB. The company said the attack has affected all Synnovis IT systems, resulting in interruptions to many of its pathology services.

“The health sector has proven to be a profitable target, which means attacks like this – on both providers and their supply chains – will continue to happen until we find ways to either boost security in the sector and/or take away the financial incentives to attack it,” said Brett Callow, threat analyst at security firm Emsisoft.

In an update posted Thursday about the incident, the NHS said its organizations across London continue to work in partnership to manage patient care following the Monday ransomware cyberattack on Synnovis (see: UK Vendor’s Attack Disrupts Care at London NHS Hospitals).

Affected NHS entities in London include Guy’s and St Thomas’ NHS Foundation Trust and King’s College Hospital NHS Foundation Trust, which “remain in a critical incident” mode, the NHS said. Oxleas NHS Foundation Trust, South London and Maudsley NHS Foundation Trust, Lewisham and Greenwich NHS Trust, Bromley Healthcare, and primary care services in South East London also continue to be affected.

“Pathology services at the impacted sites are available – albeit at a reduced capacity – with the most urgent cases being prioritized,” the NHS said.

“Unfortunately, some non-urgent operations and procedures including transplants continue to be postponed, while nearly all non-urgent blood tests have been postponed in primary care services in South East London.”

Healthcare staff are working to reschedule appointments and treatments as quickly as possible, the statement says.

Urgent and emergency services are available as usual so patients should access services “in the normal way by dialing 999 in an emergency and otherwise use NHS 111 through the NHS App, online or on the phone,” the NHS said.

Ransomware-as-a-service gang Qilin’s targets are primarily critical infrastructure sectors, and affiliate attackers keep between 80% and 85% of extortion payments, said researchers at cyber threat intelligence firm Group-IB, which infiltrated the group last year (see: Breach Roundup: Philadelphia Inquirer).

Synnovis in a notice posted on its website Thursday warned clinicians that all southeast London phlebotomy appointments are on hold.

“Please do not run any phlebotomy clinics at your practice. This action will ensure the laboratory capacity we have is reserved for processing urgent requests,” the notice says. “We are continually monitoring our laboratories’ capacity and will reinstate routine phlebotomy bookings as soon as possible.” Several phlebotomy sites specifically run by Synnovis in Southwark and Lambeth will be closed from June 10 “until further notice,” the company said.

“We are working closely with NHS Trust partners to minimize the effect of the cyberattack,” Synnovis said. “We are incredibly sorry for the inconvenience and upset caused to anyone affected.”

Synnovis declined Information Security Media Group’s request for additional details about the incident, including the speculation about Qilin’s involvement.

The NHS did not immediately respond to ISMG’s request for comment, including clarification about the type of transplants that are on hold at the affected facilities.

Other NHS Vendor Attacks

The Synnovis attack is not the first vendor incident to disrupt NHS patient services in recent years. A cyberattack last July against Ortivus, a Swedish software and services vendor, severed access to digital health records for at least two NHS ambulance services in the U.K., forcing paramedics to resort to using pen and paper to manage patient information (see: Software Vendor Attack Slows Down 2 UK Ambulance Services).

An attack in the summer of 2022 on software vendor Advanced, which contracts with the British government to provide digital services for the NHS 111, resulted in an outage lasting at least several days (see: Cyberattack on NHS Vendor Already Offering Critical Lessons).