Synnovis attack (2024)

Synnovis is a joint venture that provides pathology testing for several National Health Service trusts in south-east London. On 3 June 2024, a ransomware group encrypted its systems. The hospitals concerned could no longer quickly obtain blood test results or check blood group compatibility: more than ten thousand appointments and over a thousand procedures were postponed in the following weeks, and a national appeal went out for universal-type blood donors to make up for the inability to test. The attackers then published patient data. An analysis published later found that a patient death had been partly linked to test delays. For insurance, the case is instructive in three ways. It shows that an attack on a subcontractor produces its most serious effects at its clients, which are not the subcontractor's insureds. It illustrates the shift from intangible to bodily harm: cyber insurance, which often excludes bodily injury, and medical liability, which does not target computer attacks, pass the question back and forth. And it is a reminder that health data, whose leak triggers notifications and litigation, is among the most sensitive.