Share this article on:
A Russian ransomware gang has been linked to a cyber attack that stunted a number of major NHS hospitals in London.
Pathology services provider Synnovis Group LLP suffered from a ransomware attack from an initially unidentified threat actor, affecting five London hospitals – King’s College Hospital (KCH), St Thomas’ Hospital, Guy’s Hospital, Royal Brompton Hospital, and Evelina London Children’s Hospital.
Synnovis chief executive Mark Dollar confirmed that the company “was the victim of a ransomware cyber attack.”
“This has affected all Synnovis IT systems, resulting in interruptions to many of our pathology services,” he said, adding that the hospitals declared a “critical incident” that affected the delivery of services such as blood transfusion.
NHS said: “All urgent and emergency services remain open as usual, and the majority of outpatient services continue to operate as normal.”
“Unfortunately, some operations and procedures which rely more heavily on pathology services have been postponed, and blood testing is being prioritised for the most urgent cases, meaning some patients have had phlebotomy appointments cancelled.”
Now, Dollar has revealed that the attack has been tied to Russian ransomware game Qilin.
“We believe it is a Russian group of cyber criminals who call themselves Qilin,” he told BBC Radio 4.
“They’re simply looking for money. It’s unlikely they would have known that they would have caused such serious primary healthcare disruption when they set out to attack the company.”
I spoke to @emmabarnett @BBCr4today about the Qilin #ramsomware attack affecting healthcare in parts of London (about 48 minutes in). 👇
— Ciaran Martin (@ciaranmartinoxf) June 5, 2024
This is one of the most unpleasant & impactful cyber incidents in the UK in recent years https://t.co/JzaeTUPZu1
At the time of writing, Cyber Daily observed that Qilin’s dark web ransom blog was down, showing an 0xf2 error suggesting the site was now disconnected. There are currently no reports of the threat group claiming the attack on Synnovis Group, nor any evidence that any data was stolen or leaked.
The NHS revealed yesterday (5 June) that a team is working to assist the affected hospitals and Synnovis.
“NHS England has deployed a cyber incident response team, which is working round the clock to support Synnovis and provide emergency guidance, as well as coordinating with health services across the capital to minimise disruption to patient care,” it said.