NHS cyber attack update as blood tests unable to be carried out and operations postponed

People have been warned to be careful after cybercriminals posted stolen NHS data on the dark web. Overnight on Thursday, Qilin members shared almost 400GB of private information stolen in a cyber attack on an NHS blood testing firm.

The gang have been trying to hoard money from NHS supplier Synnovis since they hacked the company on June 3. The leaked data is understood to include patient names, dates of birth, NHS numbers and descriptions of blood tests.

The NHS has now issued a statement saying checks have been carried out on the claims. However, it said the National Crime Agency was still looking to verify the data.

It said: “On June 3, Synnovis, a pathology laboratory that processes blood tests on behalf of a number of NHS organisations, mainly in South East London, was the victim of a cyber attack. NHS England has been informed that a cybercriminal group last night published data it claims belongs to Synnovis and was stolen as part of this attack.

“The National Crime Agency and the National Cyber ​​Security Center are working to verify the data included in the published files as quickly as possible. We understand that people may be concerned about this and as more information becomes available through the full Synnovis investigation, the NHS will continue to update patients and the public on this webpage.

“A helpline has been set up and is available to answer questions. As we have more information about whether the data was leaked and what the data is, the information will be posted here first.

“Patients should continue to attend scheduled appointments and access emergency care as normal.” He went on to answer some key questions.

What happened?

Synnovis, a pathology laboratory that processes blood tests on behalf of several NHS organisations, mainly in South East London, has suffered a ransomware attack. The perpetrators of the hack now claim to have released some stolen internal data – but the National Crime Agency has yet to verify this.

What does this mean for the NHS?

The attack meant the NHS could not use some of its essential systems to carry out blood tests in south-east London. Blood tests are vital to a wide range of treatments, meaning this murder attack has caused significant disruption across south-east London across a range of different treatments.

Although this has resulted in the postponement of appointments and operations affected by the attack, it is important that patients continue to attend appointments unless they have been asked not to. All urgent and emergency services, such as A&E, urgent care centers and maternity wards, remain open as usual (although there may be some delays if people require blood tests).

Has the data been stolen?

The National Crime Agency and the National Cyber ​​Security Center are working to verify the data included in the files published by the criminals. These files are not simple uploads and therefore investigations of this nature are extremely complex and can take weeks, if not longer. As more information becomes available, the NHS will continue to update NHS patients via the NHS website here: https://digital.nhs.uk/synnovis-cyber-incident

Am I in danger of being scammed?

We have not yet been able to verify what was stolen or the claims made by the cybercriminals. You should always be wary of approaches from anyone claiming to have your data and any other suspicious calls or emails, especially if you are asked to provide personal or financial data.

If you are contacted by someone claiming to have your data, please contact Action Fraud, which is the UK’s national fraud and cybercrime reporting centre, https://www.actionfraud.police.uk/what-is -action-fraud or 0300 123 2040. Send suspicious emails to [email protected] or text to 7726. The National Cyber ​​Security Center (NCSC) has further guidance for individuals and families on data breaches here: https://www.ncsc.gov. uk/guidance. /data leaks

How do I know an email from the NHS is legitimate?

There is no suggestion that criminals gained access to the NHS email system. However, we remind you that you will not receive unexpected contacts from the NHS asking for personal or financial information.

If you receive an unexpected or suspicious email or other communication claiming to be from the NHS, you should check that it is legitimate by contacting the organization or department directly. Don’t use an address or phone number from the message itself – use the details from the official organisation’s website, for example the NHS Trust or the GP practice where you received care.

What if I am contacted by someone claiming to have my data?

Please contact Action Fraud, which is the UK’s national fraud and cybercrime reporting center https://www.actionfraud.police.uk/what-is-action-fraud or 0300 123 2040

What about suspicious text emails?

Send suspicious emails to [email protected] or messages to 7726

When will we know more?

Criminal data breaches are complex and can take time to investigate. We are working with Synnovis and law enforcement agencies as they continue their investigations.

When we are able to release more information about the attack, we will do so via the NHS website here: https://digital.nhs.uk/news/synnovis-cyber-incident

How will I know if my data has been accessed?

The investigation into the data that was stolen and released is ongoing. At this stage we are aware of reports that stolen data has been released – but specialist cyber and crime agencies have been unable to verify this. We will update the NHS website here https://digital.nhs.uk/news/synnovis-cyber-incident if people’s data has been stolen and released.

I am worried about this, but what should I do?

This website contains the most up-to-date information on the cyber incident and will be updated regularly. If you need to speak to someone about your queries, please call our Incident Helpline on 0345 8778967.

You should continue to use the NHS as normal if you are concerned about your health, but please do not contact your local hospital or GP surgery to ask if your data has been affected by this attack as they do not hold this information.

Will my appointment be cancelled?

If you have not heard from your healthcare provider, please attend your appointments as usual, as services including outpatient and community services are mostly running as usual, including cervical screening. All urgent and emergency services such as A&E, urgent care centres, the maternity ward remain open as usual (although there may be some delays if people require blood tests).

How is cyber attack affecting NHS services?

Blood tests are vital to a wide range of treatments, meaning this murder attack has caused significant disruption across south-east London across a range of different treatments. While this has resulted in the cancellation of appointments and operations affected by the attack, it is important that all patients who have not been contacted continue to attend their appointments.

Will the patient’s test results be lost?

The unprocessed samples were secured by Synnovis and stored in their laboratories. However, due to the time that has now passed, some of these samples are no longer suitable for analysis and will have to be discarded.

Synnovis is working with NHS Trusts and GP practices to determine which samples are affected and the patient information process. We understand the stress this will cause patients who have to retake their tests.

Synnovis has also put additional resources in place to ensure that urgent samples received from GP practices or hospitals can still be processed within appropriate timeframes. Synnovis still has a copy of the data encrypted in the incident and therefore historical test results will be available to doctors once IT systems are restored.

How long do you expect services to be affected?

Synnovis is focusing on technical system recovery, with plans in place to begin restoring functionality to its IT system in the coming weeks. Full technical restoration will take some time and the need to re-book tests and appointments will mean that some disruption due to the cyber incident will be felt in the coming months.

We are very aware of the disruption to patients and staff are working hard to ensure patients have all the information they need. Patients will be informed of any changes to their treatment by the NHS organization caring for them. This will be done through the usual routes of contact, including texts, phone and letters.