Mid and South Essex NHS Trust: Qilin Ransomware Data Theft

Mid and South Essex NHS Foundation Trust (MSE) has confirmed that 2,380 patient records, including diagnostic test results, were stolen during the June 2024 Synnovis ransomware attack carried out by the Russia-based Qilin cybercrime group. The trust, which operates Broomfield, Basildon, and Southend hospitals, was notified of its inclusion in the breach in December and is now in the process of contacting affected patients.

What Happened

The compromised data was exfiltrated from systems belonging to Synnovis, a third-party pathology provider responsible for analyzing blood, urine, and tissue samples for multiple NHS trusts. The initial intrusion occurred in June 2024 and primarily disrupted London-based hospitals that relied on Synnovis for testing and IT services. Following a lengthy forensic review of the stolen dataset, Synnovis has been progressively notifying downstream NHS organizations whose patient data was caught up in the theft. MSE is one of an undisclosed number of trusts affected, and last week Bedfordshire Hospitals NHS Foundation Trust disclosed that nearly 33,000 of its patients were also impacted.

What Was Taken

According to Synnovis, the leaked dataset, which was published on the dark web, may contain patient names, dates of birth, patient numbers, NHS numbers, postcodes, and test results. For MSE specifically, 2,380 records tied to specialist diagnostic testing were taken, though some records are not directly linked to identifiable patients, which is delaying final victim counts. Synnovis stated the data appeared to have been taken "in haste and in a random manner" and said there is no current evidence of malicious downstream use, though publication on dark web leak infrastructure means the information is effectively in open circulation.

Why It Matters

The Synnovis incident remains one of the most consequential healthcare breaches in UK history, and the steady drip of newly confirmed victim trusts two years after the original attack illustrates how third-party pathology and diagnostics providers have become a high-value chokepoint for ransomware crews. Health data, particularly diagnostic results tied to NHS numbers and postcodes, carries lasting blackmail, fraud, and targeted phishing utility long after the initial breach. The case also highlights the structural risk of concentrating lab and IT services in a single shared supplier across multiple trusts, where one compromise cascades into dozens of downstream notification obligations.

The Attack Technique

The intrusion was claimed by Qilin, a Russia-aligned ransomware-as-a-service operation known for double-extortion campaigns targeting healthcare, legal, and critical infrastructure organizations. While the specific initial access vector into Synnovis has not been publicly disclosed, Qilin affiliates have historically relied on compromised VPN credentials, exposed remote access services, and phishing for initial entry, followed by rapid lateral movement and bulk data exfiltration prior to encryption. The publication of stolen NHS data on Qilin's dark web leak site confirms the group followed its standard playbook of leaking exfiltrated data after ransom negotiations failed.

What Organizations Should Do

1. Inventory all third-party providers with access to patient or diagnostic data and require contractually defined breach notification timelines and forensic cooperation clauses.
2. Enforce phishing-resistant MFA on all remote access, VPN, and administrative interfaces, particularly for shared service providers handling NHS data.
3. Segment pathology, lab, and diagnostic systems from broader clinical and corporate networks to limit blast radius from a supplier compromise.
4. Monitor dark web leak sites and threat intelligence feeds for organizational names, NHS trust identifiers, and Synnovis-adjacent data references to detect downstream exposure early.
5. Prepare patient notification workflows in advance, including identity monitoring offers and clear guidance on phishing risk tied to leaked NHS numbers and postcodes.
6. Conduct tabletop exercises that specifically model a long-tail third-party breach, where exposure is confirmed months or years after the original incident.

Sources: Thousands of Essex NHS patient records stolen in cyber attack