Thousands more patient test results have been stolen in a cyber attack on the NHS, with the data published on the dark web. The Mid and South Essex NHS Foundation Trust (MSE), which runs Southend, Basildon, and Broomfield hospitals in Chelmsford, confirmed that 2,380 records were compromised.
The breach occurred in 2024, but the trust was only notified in December. It is now preparing to contact affected individuals. The stolen data came from computer drives belonging to Synnovis, a third-party pathology provider that analyses blood, urine, and tissue samples for NHS trusts.
Synnovis stated that the data was taken "in haste and in a random manner" and there is no evidence it has been used maliciously. The Russia-based cyber criminal group Qilin has claimed responsibility for the attack, which also affected several London hospitals in June 2024.
What information was stolen?
According to warnings, the breached data may include patient names, test outcomes, NHS and patient numbers, dates of birth, and postcodes. The data did not relate to systems run by MSE, but the trust has brought in cyber security experts to strengthen its own systems, as disclosed at a recent board meeting.
How will patients be notified?
Dawn Scrafield, deputy chief executive for MSE, said: "Some data is not directly linked to patients, so we are still waiting for confirmation on exact numbers. Once we have established who those patients are, we will be in contact with any who have been affected."
Other trusts affected
MSE is among an undisclosed number of NHS organisations affected. Last week, Bedfordshire Hospitals NHS Foundation Trust revealed nearly 33,000 of its patients had information stolen in the same cyber attack. Synnovis has alerted all impacted NHS trusts, with individual trusts responsible for informing patients.
