Overview
- The trust said about 2,380 patient test records were taken in the ransomware attack on Synnovis in June 2024 and it is now reviewing the stolen files to identify who was affected.
- Synnovis says the attackers published the data on the dark web on 20 June 2024 and a Russia‑linked group calling itself Qilin has claimed responsibility, with the National Cyber Security Centre and police engaged in the response.
- Mid and South Essex was notified of its involvement in December 2025 and has brought in external cyber security experts to help prepare direct patient notifications once identities are confirmed.
- The stolen files can include names, dates of birth, NHS numbers, postcodes and test results, posing privacy and identity risks even though there is so far no public evidence the data has been widely misused.
- The incident highlights wider supply‑chain risk across the NHS after other trusts reported larger losses of Synnovis‑held records and may prompt faster forensic checks and tighter oversight of outsourced diagnostic services.