33,000 patients had data stolen in trust cyber attack

A hospital provider has admitted that confidential patient information relating to almost 33,000 of its patients was stolen and shared on the dark web, two years after the cyberattack took place.

Bedfordshire Hospitals Foundation Trust sent a notice to patients on Monday after being informed by pathology systems provider Synnovis that data relating to approximately 32,927 individuals was affected.

The high-profile ransomware attack happened in June 2024, causing widespread disruption and shutting down IT systems. It primarily affected providers in south east London, which used the software for its pathology services.

However, Bedfordshire FT has only now revealed to patients it was also affected, because the trust said a lengthy review had been required to establish precisely which data had been compromised.

Historic tests carried out before November 2020 may have been affected, including names, dates of birth, patient numbers, NHS numbers, postcode, and test results going back nine years. 

The trust said files taken were not organised as a single database and were “highly unstructured, incomplete and fragmented”, and it had taken over a year of detailed analysis by specialist teams to reconstruct and understand what information was present, and which organisations it related to.

As a result, personal data within the files is fragmented, incomplete, and dispersed across multiple documents, the trust said.

Bedfordshire FT said Synnovis “provided essential services to us” and that during the attack, criminals “unlawfully accessed internal systems and extracted a set of files, which were later published on online forums known for sharing stolen data”.

Read full story (paywalled)

Source: HSJ, 2 June 2026