West Suffolk NHS Foundation Trust has confirmed that data from some of its patients were included in a breach in 2024, after a successful cyber-attack on an organisation that tests blood and other samples.
The Trust works with an organisation called Synnovis, who test blood and other samples for a number of NHS organisations.
In June 2024, Synnovis was the victim of a cyber-attack that significantly disrupted its services across the UK and resulted in some stolen data being published.
At the time, Synnovis took urgent steps to limit the impact, including obtaining an injunction to prevent further publication of the data. More information about the cyber-attack can be found on the NHS England website (opens in new tab).
All affected patients contacted
Because this stolen data was so fragmented and complex in its content, it has taken a long time for experts to piece it together and check whether it related to an individual.
Synnovis was able to confirm the stolen data included information from patients at West Suffolk NHS Foundation Trust. Names, dates of birth, NHS numbers and hospital numbers were impacted. No test results were leaked.
The Trust has written to all of the patients – around 70 individuals - whose data was part of this breach, informing them of the nature of the data and steps that have been taken as a result. Experts have confirmed the risk of harm to the affected individuals is considered extremely low.
In response to the incident, both Synnovis and the Trust have acted to limit the potential effects of the cyber-attack on patients. This included:
- Working with the national Cyber Security Centre, the NHS and the National Crime Agency to respond to the criminal ransomware attack on Synnovis’ systems
- Reporting the incident to the Information Commissioner’s Office (ICO)
- Analysing a copy of the stolen data that relates to patients at West Suffolk NHS Foundation Trust to understand who it impacted, how easily they could be identified, and consider whether there were any additional steps that patients might want to take to protect themselves.
Steps to protect yourself
You should always be alert to anyone contacting you with claims they have your data. Please be aware that Synnovis will never contact you directly about your data. You should also be alert to any other suspicious calls or emails, and avoid clicking on links or downloading attachments in suspicious emails.
If you are contacted by someone who claims they have your data, please contact Action Fraud (opens in new tab) or call 0300 123 2040 - who are the UK’s national reporting centre for fraud and cybercrime.
Further help and support
Anyone whose data was stolen in this cyber-attack will have been contacted. If you are not contacted, your results will not have been part of the breach.
We believe the risk of harm related to this breach to be extremely low but understand you may have questions or concerns about this incident. Should you require any further assistance regarding this breach please contact us by contacting PALS.
The ICO has guidance on their website on what to do if you are unhappy with how we respond to your concerns. If you contact the ICO, please include the reference ‘Synnovis incident’.