Cyberattacks are troublesome at the best of times, but sometimes they can take a much darker turn.
Case in point: Officials in the U.K. have just linked a ransomware attack to the death of a patient.
The attack, which took place in June 2024 and was widely reported at the time, targeted NHS blood services at hospitals and doctor’s offices in London and disrupted more than 10,000 appointments.
Following a special review of the patient’s care conducted by the King’s College Hospital NHS Foundation Trust, it was concluded that various factors had contributed to the patient’s death, among them a lengthy wait for the result of a blood test — a wait arising from the disruption caused by the cyberattack.
“The patient safety incident investigation identified a number of contributing factors that led to the patient’s death,” a spokesperson for the trust said in comments reported by the BBC, adding: “This included a long wait for a blood test result due to the cyberattack impacting pathology services at the time.”
The ransomware attack targeted pathology services provider Synnovis and was attributed to the Russia-based hacker group Qilin.
The breach severely disrupted patient care, leading to the cancellation of more than 1,000 operations and outpatient appointments, and caused a critical shortage of O type blood in London hospitals.
In addition to operational impacts, nearly 400GB of sensitive data — including patient names, NHS numbers, and blood test details — was stolen and published online.
Qilin told the BBC that while it was “sorry” for the harm caused, it did not accept blame. The group attempted to justify the attack as a political protest, claiming it was carried out in retaliation for the U.K. government’s actions in a war that it declined to name.
Speaking to the Financial Times, Dr Saif Abed, a former NHS doctor and specialist in cyber security and public health, described the patient’s death as “the tip of the iceberg,” claiming that it’s “a near certainty” that there have been similar deaths over the years but not recorded as such “due to a lack of official investigations.” Abed added that an independent inquiry into NHS security and patient safety should begin as soon as possible.
It’s not the first time that a cyberattack has been cited as a contributing factor in a patient’s death. In a tragic incident in 2022, a ransomware attack encrypted the servers at Düsseldorf University Clinic in Germany, forcing the transfer of a critically ill woman to another hospital 20 miles away. She arrived an hour later but died soon after arriving there.
