NHS England has said the criminals responsible for a recent cyber attack have published sensitive patient data online.
The data came from an attack on the systems of Synnovis, a pathology laboratory that processes blood tests for a number of NHS organisation and which has been widely attributed to the Qilin group.
NHS England said it has been made aware of the data that the group claimed belongs to Synnovis being published.
It added: “We understand that people may be concerned by this and we are continuing to work with Synnovis, the National Cyber Security Centre and other partners to determine the content of the published files as quickly as possible. This includes whether it is data extracted from the Synnovis system, and if so whether it relates to NHS patients.
“As more information becomes available through Synnovis’ full investigation, the NHS will continue to update patients and the public.”
Investigation underway
The attack, which took place earlier this month and affected hospital trusts and GPs in South East London, leading to the postponement of some appointments. It is now being investigated by law enforcement agencies including the National Cyber Security Centre and National Crime Agency.
According to a report by the BBC, Qilin has placed almost 400GB of data on its darknet site and Telegrame channel. It includes patient names, dates of birth, NHS numbers and descriptions of blood tests.
There are also business account spreadsheets.
The gang previously told the BBC it would publish the data unless a ransom was paid.
Update: NHS England has issued a further statement that it has not yet been able to verify what has been stolen or the claims made by the cyber criminals. It is working to verify all the data in the published files.
It has set up a helpline to answer question, and will provide further information as it becomes available.
