Did Synnovis pay the ransom?

Synnovis Confirms No Ransom Paid After Cyberattack

In the wake of a major cyberattack that disrupted critical NHS blood testing services across southeast London, Synnovis has confirmed that no ransom was paid to the attackers. The company, which provides essential pathology services to six NHS trusts, faced a severe IT systems breach that brought laboratory operations to a standstill, delaying vital test results and impacting patient care.

All compromised systems were fully replaced as part of a comprehensive recovery effort, according to Synnovis. Rather than negotiate with the cybercriminals, the organization worked closely with its NHS partners and cybersecurity experts to rebuild its digital infrastructure from the ground up. This decision, made in consultation with affected trusts, underscores a growing stance among public health providers to resist ransom demands, even under intense operational pressure.

The attack, which occurred in mid-2025, exploited vulnerabilities in third-party software, a common tactic used by ransomware groups. While the disruption lasted several weeks, Synnovis emphasized that patient data was not accessed or exfiltrated, thanks to early detection and containment protocols. Still, the incident raised serious questions about the resilience of healthcare IT systems and their reliance on external service providers.

Rebuilding without paying a ransom was a deliberate and principled choice, one aligned with UK government guidance that discourages funding criminal enterprises. While the financial and logistical costs of recovery were substantial, Synnovis noted that restoring trust and ensuring long-term security took priority. The organization has since implemented enhanced monitoring tools, multi-factor authentication, and regular penetration testing to prevent future breaches.

As the NHS continues to modernize its digital infrastructure, the Synnovis incident serves as both a warning and a roadmap. It highlights the importance of preparedness, collaboration, and ethical decision-making in the face of escalating cyber threats targeting public health.