Synnovis rebuilds IT systems following London cyber attack

More than 60 core IT systems used within laboratories are being rebuilt following the cyber attack on pathology system provider Synnovis, which disrupted healthcare services in London.

Thousands of operations and appointments have been postponed since the ransomware attack by Russian cyber crime group Qilin, which took place on 3 June 2024.

In an update published on 1 August 2024, NHS England said that Synnovis has completed full restoration of many IT systems, with final checks and assurances being made to reconnect laboratory systems with those in use by hospitals, GPs and other service users.

The full electronic end-to-end IT solution for services at the Synnovis hub laboratory has been restored and tested, meaning that the laboratory is able to start increasing capacity and efficiency with immediate effect for primary and community care services.

Dr Chris Streather, medical director for NHS London, said: “Synnovis has continued to make good progress in rebuilding its systems and capacity is now steadily increasing for routine blood tests, with more and more activity able to move back from paper-based workarounds to more efficient IT systems.

“Though this progress is extremely welcome, we recognise the impact cancellations have on our patients and also on our staff, who continue to work very hard in difficult circumstances.

“The key area we are focused on remains blood transfusion services – with services not expected to be fully restored until the autumn, we are continuing to bring hospitals across London together to manage cases and help each other by taking patients where needed”.

NHSE added that technical progress made means that primary and community care services can begin to transfer back to Synnovis on a borough-by-borough basis, with the first transfer planned for early August 2024.

Following transfer, service users will have access to the same full testing service as before the cyber attack, including routine testing.

In the meantime, previously announced mutual aid arrangements remain in place for primary and community care and continue to provide access to core non-routine tests.

The data for the eighth week after the attack (22-28 July 2024), shows that across the two most affected trusts, 1,074 acute outpatient appointments and 52 elective procedures had to be postponed because of the attack.

More than 9,423 acute outpatient appointments and 1,660 elective produces have been postponed at the two trusts since 3 June.

NHS Blood and Transplant urgently called for donations of O Positive and O Negative blood to boosts stocks following the cyber attack, which heavily disrupted services at Guy’s and St Thomas’ NHS Foundation Trust and King’s College Hospitals NHS Foundation Trust.

Meanwhile, NHS England’s cyber security operations centre is investigating a cyber security incident which took place at Norfolk and Norwich University Hospitals NHS Foundation Trust on 17 July 2024.

The King’s Speech on 17 July 2024, outlined prime minister Keir Starmer’s plans to introduce a new Cyber Security and Resilience Bill, which will expand regulation to cover more digital services and supply chains.