Synnovis Attack Halts 8,000 NHS Patient Procedures So Far

Nearly 8,000 National Health Service patient procedures including organ transplants and cancer treatments have been canceled, postponed or diverted to other facilities in London over the past six weeks since a ransomware attack disrupted blood testing firm Synnovis.

See Also: Webinar | Everything You Can Do to Fight Social Engineering and Phishing

Since the June 3 incident, 6,199 acute outpatient appointments and 1,491 elective procedures have been postponed among the two NHS trusts most affected – London’s King’s College Hospital NHS Foundation Trust and Guy’s and St Thomas’ NHS Foundation Trust – the NHS said in an update Thursday.

Although the number of acute outpatient appointments and elective procedures being postponed has fallen, the effect of the attack is disruptive and ongoing, the NHS said.

“This is still having a significant impact on patients, and I understand it is distressing when a procedure is postponed,” said Dr. Chris Streather, medical director for NHS London, in the statement.

“Across the capital we continue to work with our NHS colleagues to provide mutual aid to ensure minimal disruption to people’s care, especially in South East London. Working in partnership, NHS organizations across London are developing plans for the restoration of services.”

The ongoing disruption caused by the June 3 incident is also affecting national blood supplies, the NHS said (see: London Hospitals Seek Biologics Backup After Ransomware Hit).

Hospitals are using more of the universal blood types – O negative and O positive – than normal. “This is having an impact on national blood stocks,” the NHS said.

Synnovis in its latest update on July 1 said the cyberattack affected nearly all its IT systems, which continues to cause a significant reduction in the firm’s capacity to process samples.

Synnovis is a pathology partnership between Guy’s and St Thomas’ NHS Foundation Trust, King’s College Hospitals NHS Trust and SYNLAB.

Russian-speaking ransomware group Qilin has claimed credit for the attack. The group leaked nearly 4GB of stolen Synnovis and NHS data on the dark web in late June and reportedly demanded a $50 million ransom (see: Qilin Ransomware Group Leaks NHS Data).

The attack affected Synnovis’ analyzers’ ability to identify and process incoming samples as well as transmit test results, the firm said. “Many of these processes have had to revert to paper and manual, rather than electronic, protocols which has significantly affected capacity and delivery time frames” (see: UK Vendor’s Attack Disrupts Care at London Hospitals).

Full restoration is expected to “take some time,” Synnovis said, adding that the firm is taking a phased approach to reestablishing its technical infrastructure, “prioritizing by clinical criticality” (see: NHS Ransomware Hack: 1,500 Medical Appointments Rescheduled).

“This has included the delivery of new middleware – software that simplifies the reporting and transmission of results from our laboratory information management systems – at both Guy’s and St Thomas’ and King’s College Hospitals, which has increased our processing capacity at each,” Synnovis said.

NHS and Synnovis both declined Information Security Media Group’s requests for additional details about the incident.

The attack on Synnovis and its disruptive impact on patient services at the NHS mirror many similar recent cyber incidents on the U.S. healthcare sector and elsewhere.

In the U.S., massive disruption ensued after a February attack on UnitedHealth Group’s IT services unit, Change Healthcare, and the May ransomware attack on hospital chain Ascension.

Sen. Mark R. Warner, D-Va., on Friday sent a letter to U.S. Department of Health and Human Services Secretary Xavier Becerra and Deputy National Security Advisor Anne Neuberger urging the Biden administration to quickly develop and release mandatory minimum cyber standards for the healthcare sector.

Although HHS for months has been working on potential cybersecurity performance goal mandates for hospitals, Warner encouraged the administration to issue new regulations for healthcare imminently, especially in the wake of the Change Healthcare attack (see: HHS Details New Cyber Performance Goals for Health Sector).

“I write today to urge you to prioritize the development of mandatory minimum cyber standards and to propose them as soon as possible, given the increasing severity, frequency and sophistication of cybersecurity threats and attacks,” he said.

“Simply put, inadequate cybersecurity practices put people’s lives at risk,” Warner said.