Mid and South Essex NHS Foundation Trust (MSE) has notified patients that personal data held by the trust was compromised in the June 2024 ransomware attack on Synnovis - a pathology services provider- in which criminals unlawfully accessed Synnovis's internal systems and subsequently published stolen files on online forums associated with data theft.
The trust, which operates Chelmsford’s Broomfield hospital as well as Basildon and Southend hospitals, said the breach involved 2,380 records and that it would contact those potentially affected. It advised that, while there was no evidence that this information had been misused, potential victims should be alert to unexpected communications requesting personal information, to avoid clicking on links or opening attachments from unknown sources, and to be cautious of unsolicited calls, emails or texts referencing their details.
The cyber attack on Synnovis - a pathology partnership between Guy’s and St Thomas’ NHS Foundation Trust, King’s College Hospitals NHS Trust and SYNLAB – took place in June 2024 and impacted almost all Synnovis IT systems. The impact was greatest in South-East London, within Synnovis’ partner trusts and their local boroughs, causing delays to over 11,000 outpatient and elective procedure appointments. While appointment cancellations were confined to South-East London, data stolen in the attack may potentially relate to any of Synnovis’ service users, including some NHS hospitals, GP practices and clinics across England.
The organisation completed a forensic investigation of the data stolen from its systems in November 2025 and had notified the organisations whose data was affected by the end of that month. The stolen data, it said, was unstructured, incomplete and fragmented, requiring the use of highly specialised platforms and bespoke processes to piece together, which meant that the investigation took more than a year to complete.
The information potentially includes names, dates of birth, patient numbers, NHS numbers, postcodes and test results. The Trust said that the data's fragmented and incomplete nature significantly limits how easily it could be interpreted or linked to individuals.
Synnovis has obtained a court injunction prohibiting third parties from accessing, sharing or distributing the stolen material, and continues to monitor the online forums on which it was published.
Further information on the Synnovis cyber incident is available at www.england.nhs.uk/synnovis-cyber-incident/.
