Exclusive: Hacked London hospitals facing month of disruption

Staff tell the Spy they're expecting at least four to six weeks below capacity after NHS cyber attack

Jun 09, 2024

St Thomas’ in Lambeth, one of the hospitals hit by the cyber attack. Credit: Stephen Chung

Morning — speak to the London hospital staff caught up in this week’s cyber attack, and it’s clear the bottom has fallen out. “We’re at just 10% capacity,” one tells the Spy, after a brutal week of cancelled operations and a broken testing system. But it’s far from over yet: they say the current internal expectation is at least four to six more weeks before systems are fully back online. All the while, anxiety builds about what exactly the hackers accessed — and whether they’ll be dumping Londoners’ private medical data online. The cyber attack on London hospitals is after your Sunday round-up below.

Plus: a big London pledge from the prime minister, the finalists for a slavery monument, and the street in fear of crow attacks.

In case you missed it: a £2,500,000 donation, allegations of cronyism, “threatening phone calls” — something weird has been going on at the London Fire Brigade for a while now. On Friday we published our investigation into close ties between London firefighters and the Freemasons, a historically male-only club with influence that’s alarmed women in the brigade. Two years ago, the brigade was told to make some changes to deal with those concerns. We looked into it — and it’s not exactly gone to plan.

What we’ve spied

🗳️ LONDON VOTES 🗳️ Here’s what to know about the general election in London this week:

Rishi Sunak has pledged to scrap the capital’s ULEZ expansion if he’s re-elected as prime minister. He says he’ll reverse the introduction of the clean air scheme to outer London by mayor Sadiq Khan last year, then introduce a ban to stop any more expansions. Sunak also says he’ll require a local referendum for the introduction of new low-traffic neighbourhoods and 20mph zones — schemes now popular in some parts of London.
A new mega poll predicts the Conservatives will be practically wiped out in London at the election. The latest seat-by-seat forecast from YouGov, published on Monday, suggests that the Conservatives will be reduced to just two out of London’s 73 constituencies, based on current polling. Those are Orpington and Old Bexley & Sidcup, both on Greater London’s south east border.
Faiza Shaheen is standing as an independent in Chingford & Woodford Green, following her deselection as a Labour candidate. The seat is a marginal, with current Tory MP Ian Duncan Smith holding a tiny majority, so all bets are off on what happens now with Shaheen standing alongside Labour’s new candidate, Shama Tatler.
Green candidates standing in London are among those now being investigated over allegations of antisemitism, after the party was handed a dossier of their online activity. That includes the Green candidate for Deptford & Lewisham North, who wrote on X that “there is no peace without freedom. Resist”, the candidate for Barking, who compared Hamas to the French Resistance, as well as candidates for Brent East and Chingford.
Sadiq Khan joined Sir Keir Starmer on the campaign trail in north London on Friday for Labour’s housing policy launch. Dressed in a hard hat and high-vis jacket, the mayor appeared alongside his party’s leadership as they announced a mortgage guarantee scheme designed to get more young people on the property ladder.

🤳 Dramatic footage of the arrest of a prolific phone snatcher in central London went viral this week. City of London Police posted the video on Wednesday, which shows 28-year-old Sonny Stringer, from Islington, riding through London on a high-speed e-bike before being knocked off by officers in an unmarked police car, who then tackle him to the ground. The video was posted the day after Stringer appeared at Isleworth crown court to plead guilty to stealing 24 phones in one morning. Stringer’s arrest has prompted renewed calls for a crackdown on phone theft in the capital, which is increasingly being committed by thieves riding bikes and mopeds. London’s victims commissioner, Claire Waxman, said the muggings were leaving victims suffering from long-term trauma and creating fear in public spaces. The most recent data showed a phone was stolen every six minutes in London in 2022, and phones now accounted for nearly 70% of all thefts in the city. While we’re on phones: 17 of the 20 state secondary schools in Southwark have announced they’re banning smartphones.

🗿 City Hall has unveiled the shortlist for the Docklands slavery memorial — and culture war crusaders have inevitably followed in its wake. Six finalists have been announced for the memorial at West India Quay, the first of its kind in the UK to honour the victims of the transatlantic slave trade, and Londoners are being invited to vote online for their favourite. Mayor Sadiq Khan has earmarked up to £500,000 for the winning piece, and finalists include a giant cowrie shell and a series of stone structures representing a ripple. One entry has been leapt on by some though: Nana Buluku, a 40ft structure depicting an African goddess. "She is positive and colourful. Her embodiment is mythic yet futuristic, unashamedly black and beautiful. She is Black Pride,” explains its designer, Zak Ové. Telegraph columnist Michael Mosbacher was less than impressed: “London doesn’t need an African Goddess, Sadiq Khan. Why not British abolitionists?”

🗺️ FROM THE BOROUGHS 🗺️ Likely a few red faces in Lambeth town hall, after news this week that Pop Brixton has gone into administration. The hip shipping container village was set up ten years ago, when Lambeth councillors sold off an old public car park in a deal that was meant to see the council paid a share of the profits. Except, Pop Brixton never made an annual profit, and it’s now appointed administrators, who will see if the venture can be saved, or must be liquidated. This long read from Brixton Buzz in 2016 dives into what the council could have done with its land instead. Up north, Camden council is once again in trouble for trying to move on the homeless. This week the council cleared away tents used by rough sleepers from outside its offices to make way for new bike stands and plant plots — leading to claims it’s creating a ‘hostile environment’ in the borough. You may remember Camden faced backlash last year when it helped organise a bin lorry to dispose of homeless tents outside a hospital, resulting in this infamous video. In east London, Redbridge council has approved plans to build a lido, the first in the capital for decades. Councillors on the planning committee gave the thumbs up to a new lido in Valentines Park, Ilford, which will bring the total number across London to 16. Construction is expected to begin later this year and it may open as early as autumn 2025. The lido is an in-house council project — which has raised a few eyebrows, given Redbridge’s recent record. Lastly, Kensington & Chelsea council’s leadership have approved a scheme to give victims of the Grenfell Tower fire £42m in direct payments until 2028. It means survivors and the bereaved will be able to receive between £1,500 and £8,000, either in a lump sum or an annual payment.

🚨 “I wish it was me,” the real target of last week’s shooting in Dalston has allegedly said, as a nine-year-old girl caught in the crossfire remains in hospital in critical condition. The Sunday Times reports that Beytullah Gunduz, a 37-year-old man from Finsbury Park with links to the Turkish underworld, has said he believes he was the real target of the drive-by shooting outside Evin restaurant on Kingsland Road last Wednesday. Gunduz says he escaped unharmed, because he had stepped away from the restaurant for 15 minutes, at which time the girl and three adult men were shot by a person on a motorbike. Gunduz has reportedly told a friend:

If these people knew I was there why didn’t they wait until I left and walked around the corner? We can be criminals but this girl was not. She didn’t do anything wrong. It is killing me inside. The waiting to know if she is going to live is too much. I am heartbroken.

It comes as the Met Police appealed once again for information about the shooting, particularly information on the motorbike it recovered, having made no arrests yet. In its latest statement, issued this Wednesday, the force for the first time confirmed it’s focusing on “Turkish-originating organised criminal networks” as a major line of inquiry. Meanwhile, the Met has stepped up patrols in Dalston, including with officers from the Met’s Turkish Police Association and specialist firearm officers.

📣 A London university is taking students who built a pro-Palestine encampment to court. Queen Mary University of London, in Mile End, lodged a possession order against protesting students in the high court on Friday, in a case that could have legal ramifications for pro-Palestine encampments across the UK. QMUL administrators say they’ve taken the action due to “health and safety risks”. If approved, students will be given legal notice to pack up their tents and leave — which may pave the way for a showdown. Watch this space.

💰 One of London’s richest landlords just got married, though proceedings didn’t go entirely to plan. The Duke of Westminster, aka Hugh Grosvenor aka ‘Hughie’ to his pals, got married to Olivia Henson at Chester Cathedral on Friday, with best mate Prince William among attendees. The Duke owns vast swathes of central London through his real estate company Grosvenor Group, thanks to the aristocratic title he inherited aged just 24 — all in all 300 acres across Mayfair and Belgravia. His portfolio was valued at £10.1bn in 2024 by the Sunday Times, and London properties include Grosvenor Square, South Molton Triangle, Cundy Street Quarter, 20 Balderton Street and Holbein Gardens. Anyway, just as Hughie was leaving the cathedral with his new bride, Just Stop Oil protesters used fire extinguishers to shoot powdered paint in the air. “Hugh Grosvenor: inherits £10 billion. Young people: inherit societal collapse,” said the group posting footage to X. “You IDIOT!” shouted one annoyed wedding watcher.

🔍 And finally, we leave you with:

‘We’re at 10% capacity’: Inside the London hospital hack

So far it’s been silent on the dark web channels of a Russian hacking group, who are suspected of launching a cyber attack on London hospitals this week and may have access to Londoners’ private health data.

The consequences of the hack have been devastating, leading to Londoners having crucial surgery cancelled — including cancer treatment and organ transplants — and blocking GPs from testing blood across swathes of south east London.

The hack was detected on Monday, when the computer systems of a pathology contractor that handles blood tests for St Thomas’ and Kings College hospitals keeled over.

Oxleas NHS Foundation Trust, South London and Maudsley NHS Foundation Trust, Lewisham and Greenwich NHS Trust and Bromley Healthcare have also all been impacted by the hack, declared as a “critical incident” by the NHS.

Yet we’re a week on and the disruption is far from over. A hospital source tells the Spy that IT systems aren’t expected to return to normal for another four to six weeks, while testing capacity has now plunged to 10% of what it once was.

A key question also now lurks in the background: what kind of private health data have the hackers accessed, and will they dump it online?

As of Saturday evening, the Spy has found no posts relating to the NHS London cyber attack on the dark web pages and Telegram channels of Qilin, the Russian hacking group believed to be behind the attack.

These channels are where the group dumps the data it’s stolen, with the accompanying messages suggesting this is because the targeted organisations and companies have failed to pay Qilin’s ransom demand.

One recent UK victim of the group was The Big Issue magazine, with Qilin dumping 550GB of stolen data online in May, including the salary information and driving license of the mag’s CEO.

In this week’s attack, Qilin have targetted a company called Synnovis, which handles blood tests for much of the NHS in London.

It’s unclear if Synnovis or NHS London have received a ransom demand — such a detail has been absent from their public statements. For now at least, it looks like any confidential London patient data has been kept offline.

But, from the Spy’s conversation with an anonymous source at one of the hospitals, it seems the technical disruption is far from over.

A staff member at one of the affected London hospitals tells us that while it’s believed the hack has now been “isolated”, it could still take at least four to six weeks before systems are fully back online.

In the meantime, they say blood testing has now fallen to just 10% of normal capacity, with patients in need of urgent care prioritised, as staff resort to a paper-based system for testing.

“It started on Monday, when we started getting pestered about blood tests taking a while,” the staff member explains. “Delays are normal to some extent, but it soon became clear the entire system had stopped working.

“That afternoon we were just told it was a general ‘IT problem’. It was only until later in the week that we heard about this hacking group”.

The hacked blood testing system is used across both emergency and elective care in the affected hospitals, but with fewer tests to go around, it’s patients in A&E departments that are now the focus.

“Our first reaction to the outage was what it would mean for patient safety. Very quickly it became ‘everything’s got to be for what’s urgent’”.

Blood transfusions have been particularly hit by the outage in testing, but more general kinds of surgery have ground to a halt too, because the blood tests needed for patient workups are now unable to take place.

To some extent staff were prepared for the lack of IT though, due to a previous systems outage at the London hospital in 2022. “That wasn’t a hack – our servers just melted, basically. But that experience meant we were ready for the switch to paper.”

Staff and patients now face weeks of disruption, and a long grind before testing gets back to normal. “We’re aiming to get back to 20% capacity next week,” the staff member tells us.

The wait is a struggle. Among the Londoners with a cancelled operation was a man who was due to have surgery on a cancerous tumour on June 6. “My depression is now acute and I am finding it very hard to cope,” they posted to social media. “I do not have a date now for the surgery.”

NHS London has been giving daily statements on the hack, including on Saturday, June 8.

A spokesperson said:

NHS staff are working around the clock to minimise the significant disruption to patient care following the ransomware cyber-attack and we are sorry to all those who have been impacted.
Pathology services are integral to a wide range of treatments and we know that a number of operations and appointments have been cancelled due to this attack.
We are still working with hospitals and local GP services to fully assess the disruption, and ensure the data is accurate.
In the meantime our advice to patients remains, if you have not been contacted please do continue to attend your appointments.