WannaCry Was a Warning — Not a Wake-Up Call
In May 2017, WannaCry shut down 80 NHS trusts, cancelled 19,000 appointments, and caused an estimated £92 million in damages. The National Audit Office concluded that the entire attack was preventable — every affected system was running unpatched Windows software. Seven years later, the lessons have still not been fully absorbed. NHS Digital's own 2023 assessment found that 21% of NHS trusts still failed to meet basic Cyber Essentials standards. The systemic underinvestment in healthcare IT infrastructure means the sector remains uniquely vulnerable to attacks that other industries patched years ago.
Synnovis 2024: The Anatomy of a Modern Healthcare Attack
In June 2024, the Qilin ransomware group hit Synnovis, the pathology services provider for Guy's and St Thomas' and King's College Hospital NHS Foundation Trusts. Over 10,000 outpatient appointments and 1,700 elective procedures were cancelled in the first two weeks. Blood transfusion matching was disrupted, forcing hospitals to use universal O-type blood and depleting national reserves. Qilin published almost 400GB of stolen patient data on the dark web, including patient names, dates of birth, and NHS numbers. The attack demonstrated that modern healthcare ransomware is not just about encryption — it is about exfiltrating patient data and weaponising it for double extortion.
Why Healthcare Is Structurally Vulnerable
Healthcare organisations face a unique combination of risk factors that no other sector shares. Legacy medical devices running obsolete operating systems cannot be patched without voiding manufacturer warranties. Clinical urgency means downtime is measured in patient harm, creating enormous pressure to pay ransoms. The shift to electronic health records has concentrated vast quantities of sensitive data in systems designed for clinical access, not security. A single patient record sells for up to $250 on dark web marketplaces — ten times the value of a credit card number. Hospitals also operate 24/7 with thousands of endpoints including IoT devices, nurse stations, and diagnostic equipment, making comprehensive endpoint coverage extraordinarily difficult.
- Legacy medical devices with unpatched operating systems
- Clinical urgency creating extreme downtime pressure
- Patient records worth 10x more than financial data on dark web
- Thousands of IoT and diagnostic endpoints per hospital
- Chronic underinvestment in healthcare IT security
What Healthcare Organisations Must Do Now
The DSPT (Data Security and Protection Toolkit) is a starting point, not a finish line. Healthcare providers need to move beyond compliance checklists and address the structural gaps that attackers exploit. Network segmentation between clinical and administrative systems is essential — the Synnovis attack spread precisely because pathology services were deeply integrated with hospital networks. Anti data exfiltration technology should be deployed on every endpoint to ensure that even if attackers gain access, patient data cannot leave the network. Most critically, incident response plans need to be tested quarterly, not filed in a drawer. The organisations that recovered fastest from Synnovis were those with practised playbooks and pre-arranged relationships with incident response providers.
Frequently Asked Questions
How much did WannaCry cost the NHS?
The Department of Health estimated the total cost at £92 million, including £19 million in lost output from cancelled appointments and £73 million in IT costs for recovery and infrastructure upgrades. However, the true cost including long-term patient harm from delayed treatments has never been fully quantified.
What data was stolen in the Synnovis breach?
The Qilin ransomware group published almost 400GB of data including patient names, dates of birth, NHS numbers, and blood test results. The data covered patients across Guy's and St Thomas' and King's College Hospital NHS Foundation Trusts.
Why are hospitals targeted more than other organisations?
Hospitals are high-value targets because clinical urgency creates pressure to pay ransoms quickly, patient records are worth up to $250 each on dark web markets, legacy medical devices are difficult to patch, and the shift to electronic health records has concentrated sensitive data in systems with large attack surfaces.
What is the DSPT?
The Data Security and Protection Toolkit is an online self-assessment tool from NHS England that measures compliance against the National Data Guardian's ten data security standards. All organisations processing NHS patient data must complete the DSPT annually.