Thousands more NHS patient records confirmed stolen in Synnovis cyberattack

Mid and South Essex NHS Foundation Trust working to contact those whose data was breached

Thousands of patient records held by an NHS trust in Essex have been confirmed among data stolen during a major ransomware attack that disrupted healthcare services across England nearly two years ago.

Mid and South Essex NHS Foundation Trust (MSE) said 2,380 patient records were compromised in the cyberattack on laboratory services provider Synnovis in June 2024.

The trust, which operates Broomfield Hospital in Chelmsford, Basildon University Hospital and Southend University Hospital, said the affected information was held by Synnovis, a third-party company responsible for analysing blood, urine and tissue samples.

MSE said it was informed of the breach in December 2025 and is now working to identify and contact patients whose information was exposed.

Deputy Chief Executive Dawn Scrafield said the stolen records related to a range of specialist diagnostic tests.

"Some data is not directly linked to patients, so we are still waiting for confirmation on exact numbers," she said.

Widespread disruption

The cyberattack on Synnovis was one of the most significant incidents to hit the NHS in recent years.

The breach, which came to light in June 2024, severely affected a number of hospitals in London that relied on Synnovis for pathology testing and digital services. Thousands of outpatient appointments and planned procedures were cancelled as healthcare providers struggled to restore systems and maintain services.

The latest disclosure follows the announcement by Bedfordshire Hospitals NHS Foundation Trust last week that nearly 33,000 of its patients had also been affected by the same attack. Bedfordshire Hospitals said it believed the risk of misuse remained low because the stolen information was fragmented, historical and not stored in an easily accessible format.

It added that Synnovis continued to monitor online forums where the material had been published. According to Synnovis, the stolen data was later uploaded to the dark web.

The company says there is no evidence that the information had been used maliciously, describing the theft as having been carried out "in haste and in a random manner".

The stolen records may include names, dates of birth, NHS numbers, patient identification numbers, postcodes and medical test results.

A Russia-based cybercriminal group known as Qilin previously claimed responsibility for the attack.

The group published more than 400GB of data allegedly taken from organisations served by Synnovis.

Prolonged investigation

Cybersecurity experts have raised concerns about the length of time it has taken to establish the full scale of the breach.

Lee Sult, Chief Investigator at cybersecurity firm Binalyze, said the prolonged investigation risked undermining confidence in the healthcare sector's ability to respond to cyber threats.

"If we're still trying to determine the true scale two years later, it's less an investigation than a slow-burn crisis," he said.

He warned that delayed disclosures and fragmented investigations could encourage further attacks by signalling weaknesses in how organisations detect and respond to intrusions.

Mr Sult said healthcare providers faced particular challenges because patient data is shared across extensive networks of internal systems and external suppliers, creating multiple potential points of vulnerability.

"Knowing how the attacker got in is only the start," he said. "Containing damage and telling patients the truth quickly is the real task."

Earlier this year, the NHS announced plans to strengthen oversight of suppliers' cybersecurity arrangements following a series of high-profile cyber incidents affecting heathcare services.