A laboratory company hit by a cyber attack earlier this month has confirmed that patient data was published by the cyber criminals, NHS England said.
Last week, a cyber crime group – Qilin – published data which they claimed belonged to NHS patients, but NHS England and the company said an investigation was required to determine whether this was true.
This followed a major ransomware cyber attack at the start of this month on Synnovis, a provider of lab services for a group of London hospitals.
Now, the company has ‘been able to confirm that this data was stolen from Synnovis’ systems’.
Synnovis has found ‘no evidence’ that a ‘copy of the database’ – with patient test requests and results – was published.
However, the ‘administrative working drive’, which contains ‘some fragments of patient identifiable data’, has been posted online in a ‘partial form’.
The company said that understanding this is their ‘current priority’, and the investigation is still ongoing with further work needed to establish the full scale and nature of the data released and which patients have been impacted.
GPs in South East London said earlier this week that they continue to encounter difficulties as a result of the cyber attack, and will likely be dealing with the aftermath for the next year.
Many GP-requested pathology tests have been postponed until further notice, and GPs are concerned about a mounting backlog, particularly for long-term condition management.
Yesterday, Synnovis said: ‘Last week a group claiming responsibility for the cyberattack published data online. We have now been able to confirm that this data was stolen from Synnovis’ systems.
‘An analysis of this data is already underway. This analysis, conducted by technical experts, aims to confirm what information it contains.
‘Unfortunately, it is too soon to be able to confirm the exact nature of the information and the organisations and individuals it relates to.’
NHS England said: ‘As more detail becomes available through Synnovis’ full investigation, the NHS will continue to provide updates and a helpline has been set up to support people impacted (incident helpline: 0345 8778967).
‘Investigations of this type are complex and can take time. Given the complexity of the investigation it may be some weeks before it is clear which individuals have been impacted.’
The national commissioner also said that local health systems’ are continuing to ‘manage the impact on patients’ with additional resources put in place to ensure urgent blood samples are still processed.
A version of this story was first published on our sister title Pulse.
