Blood Supply Still Affected by June 2024 Vendor Attack

The National Health System in England is still dealing with blood supply issues one year after a ransomware attack on a British pathology laboratory services provider disrupted patient care and testing services at several London-based hospitals and triggered a nationwide shortage of type O-negative blood.

See Also: A Modern Approach to Data Security

The National Health Systems Blood and Transplant in an advisory said it is urging one million people in England to donate blood to “secure” the nation’s supply.

The plea from the NHSBT comes one year after a June 2024 cyberattack on pathology laboratory Synnovis disrupted the firm’s ability to perform a host of services, including blood testing, leading to the cancellation or postponement of 10,152 acute outpatient appointments and 1,710 elective procedures at the most affected NHS trusts – London’s King’s College Hospital and Guy’s and St. Thomas hospitals. Those trusts have a pathology partnership with Synnovis.

“In July 2024, NHSBT issued an Amber Alert due to a severe shortage of O-negative blood triggered by the cyberattack on London hospitals,” the advisory on Monday said (see: UK Blood Stock Drops After Ransomware Hack).

“Blood stocks have remained low and following several bank holidays in quick succession, there is now a pressing need to avoid a Red Alert, which would mean demand far exceeds capacity, threatening public safety,” the NHSBT said. “This can be avoided if more donors come forward to fill the available appointment slots – particularly in the town and city center donor centers.”

O-negative blood is known as the universal blood type since it is safe for transfusion to patients of any blood type.

‘Maximum Disruption’ to Hospitals

The Synnovis ransomware attack was one of the most disruptive in the healthcare sector last year. Russian-speaking ransomware group Qilin claimed responsibility for the attack.

“The ransomware attack on Synnovis was a deliberate intent to cause maximum disruption to the healthcare system in the UK, and interfere with the delivery of life-saving treatments for large swaths of the British population,” said John Riggi, national adviser of cybersecurity and risk at the American Hospital Association.

A NHSBT spokesperson declined Information Security Media Group’s request for additional details about the lingering impact of the Synnovis cyberattack on the NHS. “Our systems were not directly affected by the [Synnovis] cyber incident, but we experienced the knock-on effect due to the inability of hospitals to cross match blood,” she said.

Phil Englert, vice president of medical device security at the Health Information Sharing and Analysis Center, said several factors are likely contributing to the protracted NHS blood shortage following the Synnovis attack.

“This is the start of the summer holiday season, which historically is a high-demand and low-supply situation. People donate less blood during the summer,” he said.

Also, with more people working remotely, collections through employer-sponsored blood drives likely have declined, he said.

“This may not be an NHS issue alone,” he said. In January 2025, the American Red Cross also issued a call for donations to help avoid blood supply shortages during the flu season.

Critical Supplier Attacks

The attack on Synnovis in the United Kingdom last year was also among several cyber incidents affecting blood centers and related blood organizations elsewhere.

In the U.S., a New York blood center with divisions serving hospitals in several states in January dealt with ransomware attack that also disrupted donations and related activities. The attack on New York Blood Center Enterprises, NYBCe, came just days after the center declared a regional blood shortage emergency (see: NY Blood Center Attack Disrupts Suppliers in Several States).

Also, an August 2024 ransomware attack on a Florida-based blood center OneBlood and an April 2024 attack on Octapharma Plasma, the U.S. operations of a Swiss pharmaceutical maker, each disrupted blood collection and processing operations for several weeks.

The attacks on blood suppliers last year also triggered alerts from government agencies – such as the Food and Drug Administration – and industry organizations.

That included a joint threat bulletin from the Health-ISAC and the AHA warning of attacks on third-party blood suppliers and related entities (see: Attacks on Blood Suppliers Trigger Supply Chain Warning).

“The blood supply is as essential as water and electricity in healthcare,” Riggi said. “To attack it, knowing the immediate risk to patient and population safety is equivalent to an act of cyber terrorism. Make no mistake, these are not data theft crimes, they are threat-to-life crimes,” he said.

“The attack and those like it, should result in the imposition of swift and certain consequences against the perpetrators, to impart justice and to deter other similar attacks such as the OneBlood ransomware attack impacting Florida hospitals last August,” he said.

The lingering effects and blood shortage in the UK attributed in part to the Synnovis cyberattack one year later, demonstrates the level of danger posed by these incidents, he added.

“It is also serves as an urgent notice to all in healthcare – the bad guys have mapped our sector and identified mission-critical and life-critical healthcare third-party service providers and supply chains, like Synnovis and Change Healthcare,” he said.

“It is incumbent upon on all essential healthcare third parties to ensure not only that they have proper cyber defenses in place, but also to ensure that they have the redundant capabilities to be resilient and recover quickly, when a cyberattack strikes.”

Errol Weiss, chief security officer at Health ISAC, said the Synnovis incident also highlights the importance of international cooperation in addressing cyberthreats.

“Threat actors often operate across borders, and their actions can have global repercussions. Sharing intelligence, best practices and resources among nations and organizations is essential to combating these threats effectively,” Weiss said.

As more organizations participate in these initiatives, the entire ecosystem becomes stronger, better prepared and more resilient against the evolving cyberthreat landscape, he said.

“The healthcare sector must recognize that cyber resilience is an ongoing process, not a one-time effort,” Weiss said. “As threats evolve, so must our defenses. This requires continuous investment in technology, training and partnerships to stay ahead of adversaries and protect the critical services that patients depend on.”

The most disturbing aspect of these attacks are the human cost of these disruptions. “Thousands of procedures and appointments were postponed or canceled and patients requiring urgent care faced delays” following the Synnovis attack, Weiss said.

“This highlights the tangible, life-threatening consequences of cyberattacks on healthcare systems,” he said. “It also underscores the need for greater investment in cybersecurity, supply chain resilience and information sharing across the health sector to protect patient safety.”