Synnovis has concluded its complex 18-month investigation into the June 2024 ransomware attack by the Qilin cybercrime group, which severely disrupted pathology services across London and is believed to have contributed to at least one (1) patient’s death. The attack resulted in the exposure of sensitive data, including NHS numbers, names, dates of birth, and possibly intimate medical conditions such as cancer and sexually transmitted infections. CaseMatrix estimates that data from over 900,000 NHS patients was compromised, although Synnovis has not confirmed this figure. The investigation faced challenges due to the fragmented and unstructured nature of the stolen data, requiring specialized platforms and processes to piece together the information. Synnovis has begun notifying affected NHS organizations, which are responsible for informing individual patients under UK data protection laws. The company warned that patient notifications may take time and advised checking healthcare providers’ websites for updates. Synnovis and its NHS Trust partners decided not to pay a ransom, reflecting their commitment to ethical principles and the rejection of funding future cybercriminal activities. The Qilin gang, suspected to be of Russian origin, typically uses double-extortion tactics, exfiltrating data before encrypting systems and threatening to publish stolen material if ransoms are not paid. The group told The Register that its attack on Synnovis was deliberate, stating that “all of our attacks are not accidental” and that they target companies affiliated with political elites of certain countries. Synnovis has replaced all affected infrastructure, but the exact method of the attackers’ initial entry remains undetermined.