Synnovis completes forensic review following 2024 cyberattack — notifications under way
Synnovis, a pathology partnership between Guy’s and St Thomas’ NHS Foundation Trust, King’s College Hospitals NHS Trust and SYNLAB, has completed the forensic investigation of the data stolen from our systems following the ransomware cyberattack we experienced last year.
This calculated attack on critical UK healthcare infrastructure impacted almost all Synnovis IT systems and resulted in interruptions to many of our pathology services. By late Autumn 2024, access to all services that were available prior to the cyberattack was restored.
Data Notifications
We have now begun notifying the organisations whose data was affected and expect to conclude this process by 21 November 2025. This marks the latest stage of investigation that has taken a large team of forensic experts and data specialists over a year to complete. The stolen data was unstructured, incomplete and fragmented, requiring the use of highly specialised platforms and bespoke processes to piece it together – factors which heavily influenced the duration of the investigation.
We do understand patients may be concerned and have established a dedicated website to provide additional information and answers to common questions for both organisations and patients. This can be accessed here.
Mark Dollar, CEO, Synnovis:
“We know that last year’s criminal cyberattack caused a great deal of disruption, concern and upset to patients, our frontline NHS colleagues, and other service users and we sincerely apologise for this. I must also recognise and thank our own people who worked tirelessly to minimise any impact and remained dedicated to patient care.
“It has taken more than a year of painstaking investigation to decipher and piece together the data stolen in this smash-and-grab cyberattack. I’ve seen first-hand the scale of the challenge - even for leading cyber experts – to tackle the random and fragmented nature of the data scraped from our systems.
“Our focus now turns to notifying the organisations affected. We are offering our full support as they determine their next steps, including dedicated contact points, supporting materials and a website we’ll keep updated with relevant information.”
-ENDS-
Editors’ Note
- Under UK data protection law, each impacted organisation is responsible for assessing the information provided by Synnovis and determining their subsequent obligation to make any relevant notifications.
- Synnovis does not have, and never has had, access to NHS Patient Records.
- The National Cyber Security Centre (NCSC) provides useful advice on steps an individual can take following a data breach: https://www.ncsc.gov.uk/guidance/data-breaches.
Media Contact:
synnovisqueries [at] fticonsulting.com
