Synnovis put a price on pathology consolidation that no contract carried

The week

On Monday, June 3, 2024, doctors and nurses across south-east London ran into a problem most of them had never imagined: they could no longer count on getting blood test results. The cause was a ransomware attack on Synnovis, the organization that runs pathology for much of that part of the city. The attack was later attributed to a criminal group known as Qilin.

Qilin, also tracked as Agenda, operates as ransomware-as-a-service. Its developers rent their malware and leak site to affiliates, who break into victims and share any ransom with the operators. That model lets one brand run many attacks at once, against targets chosen largely by opportunity.

Ransomware is malicious software that criminals sneak into a computer network. Once inside, it scrambles (“encrypts”) files and systems so they cannot be used, and the attackers demand payment for the key to unscramble them. Many gangs also copy data out first and threaten to publish it. The effect resembles a burglar who changes every lock in a building and leaves with the filing cabinets.

Pathology is the hospital work patients rarely see: the laboratories that analyze blood, tissue and other samples and send the results back to clinicians. Synnovis is a pathology partnership between the laboratory company SYNLAB and two London hospital trusts (the public bodies that run NHS hospitals), Guy’s and St Thomas’ and King’s College Hospital. It was created in 2021 from an earlier joint venture, under a long-term contract.

Synnovis later described the attack as affecting all of its IT systems. That breadth is what turned a company’s incident into a regional one. The partnership processed work for the two trusts’ hospitals and for GP practices across Bexley, Bromley, Greenwich, Lambeth, Lewisham and Southwark. Every one of those routes ran through the same laboratory systems.

When its systems went down, blood testing, transfusion support and results reporting across much of south-east London were disrupted. The two trusts declared a critical incident, the NHS’s formal signal that normal services cannot be safely delivered and extra measures are needed. Under the NHS emergency preparedness framework, a critical incident is narrower than a major incident, which calls for a wider multi-agency response. Its declaration unlocks mutual support, extra staffing and a formal command structure inside the health service. GP practices, the family doctors who are most patients’ first stop, saw blood test capacity sharply cut across six boroughs.

The first days were spent sorting patients. Hospitals postponed planned operations and outpatient appointments to save the remaining testing capacity for emergencies and the most urgent care. GP practices were asked to limit blood tests to the clinically urgent. NHS England’s London region coordinated the response across hospitals and primary care, and Synnovis reported the attack to the National Crime Agency, the National Cyber Security Centre and the Information Commissioner’s Office.

One detail showed how quickly a data problem becomes a physical one. Before a transfusion, staff need to know a patient’s blood group, and normally that comes up in seconds from electronic records. Without fast electronic access to blood group results, hospitals fell back on O-type blood, which can be given to patients whose type is not yet confirmed. That draws heavily on a limited supply. On June 10, NHS Blood and Transplant appealed for O-negative and O-positive donors to come forward.

The appeal reached far beyond London. The national blood service asked donors across England to book appointments, because a regional shortfall in one blood type is met from national stock. A ransomware attack on one company’s servers had become a request to the public to roll up their sleeves.

On June 20, the attackers published data taken in the attack. Synnovis then obtained a court injunction to prevent further publication of the material. The company later said the data had been taken hastily and at random from working drives, and not from its primary laboratory databases. Working out what had been taken, and whose data it was, would take far longer than restoring service.

By then it was clear this was not a short IT outage. A whole region had lost a service it had organized around a single partner, and the hospitals, family doctors and patients relying on it were absorbing the consequences.

The attack also arrived in a year already shaped by a supplier outage in health care. In February 2024 a ransomware attack on Change Healthcare, a claims and payments processor owned by UnitedHealth Group, had disrupted billing and pharmacy services across the United States for weeks. Pharmacies struggled to process prescriptions, and many physician practices went weeks without claims payments. Two health systems on two continents had now seen what happens when a single supplier sits under a whole system’s daily work.

Pathology is a classic case for consolidation. Laboratories have high fixed costs, expensive analyzers and scarce specialist staff. Pooling the work of several hospitals and their GP practices into one operator lowers the cost per test, and the saving recurs every year. The business case for a partnership like Synnovis counts those savings with care.

What it rarely counts is the other side of concentration: a low-probability event in which the whole region loses the service at once. That loss is large, lumpy and slow to recover from. In June 2024 it arrived, and it landed on parties who had never agreed to carry it.

Three places should have priced it, and none did: the contract, the spare capacity around it, and the allocation of the financial loss. We take them in that order, because each is a decision made years before any incident. First, though, a word on what a modern laboratory actually is, and why ransomware hits it so hard.

What a pathology network really is

Most executives picture a laboratory as a room full of machines and people in white coats. That is part of it. The other part, and increasingly the more important part, is software. A doctor orders a test in the hospital’s electronic patient record. The order travels to the laboratory’s own system, usually called a laboratory information management system, which tracks every sample from arrival to result. Analyzers report their readings into that system. Specialists review and sign off. The result then travels back to the right patient’s record, where the doctor sees it.

The connections that carry orders and results between these systems are called interfaces. An interface is simply an agreed way for two pieces of software to pass information to each other. In a consolidated network there are many of them: to each hospital, to dozens of GP practices, to the blood bank, to the transport and courier systems that move samples around.

Where the dependencies run

The software reaches into steps that look physical. Sample tubes carry barcode labels generated by the laboratory system, which link each tube to a patient and an order. Analyzers often receive their work lists from the same system, so they know which tests to run on which tube. Quality control results, which show the analyzers are measuring correctly, are logged there too.

The transfusion laboratory has its own dependencies. It holds the history of each patient’s blood group and antibodies, the record of which units went to whom, and the rules that decide which blood can safely be issued. Stock management, the tracking of units by type and expiry date, also runs through software. Losing it means losing the ability to match blood to patients quickly and to show afterwards what was given.

Results travel outward through several channels. Hospital results flow into the electronic patient record. GP results flow into the practice systems that family doctors use. Critical results, such as a dangerously high potassium level, are telephoned to clinicians, and the call itself is logged. Each channel has its own interface, its own failure behavior and its own manual fallback.

Ransomware does not need to touch a single test tube to stop all of this. If the laboratory’s systems are encrypted, samples can still be drawn, and analyzers may even still run. But the laboratory can no longer reliably know which sample belongs to which patient, which tests were ordered, or where to send the answer. Staff can fall back on paper and telephone, but manual working handles a small fraction of normal volume, and every manual step adds a chance of error. In medicine, a result sent to the wrong patient can be worse than no result at all.

Why blood group history matters so much

The O-type blood appeal had a specific mechanism. UK transfusion guidelines generally expect a patient’s blood group to be confirmed on two separate samples before blood matched to their own group is issued. One of those can be a historical result held in the laboratory system.

For most patients with any hospital history, that historical record does the work. With the record unreachable, many patients could no longer meet the two-sample standard quickly. The safe alternative is group O blood, which suits patients of any group. Demand for O blood rises sharply, and a national supply feels the strain.

The mechanism matters for planning. The data needed was small: a blood group and antibody history per patient. The consequence of losing access to it was national. Few business continuity plans rank data by consequence of loss rather than by volume or system, yet that ranking is what would have flagged this table as critical.

That is why hospitals affected by a pathology outage do more than “slow down.” They have to decide which patients get the scarce testing capacity that remains, and they postpone the rest. Operations need blood tests before and after. Cancer clinics need them to decide on treatment. Emergency departments need them constantly.

It also explains why shared suppliers are attractive targets. Criminals who encrypt one hospital disrupt one hospital. Criminals who encrypt a company serving many hospitals and practices disrupt all of them at once, and the pressure to restore service quickly is correspondingly greater. A supplier at the center of a region’s clinical work is, from an attacker’s point of view, a single way into many organizations.

Recovery is slower than most leaders expect. Restoring from backups is only part of the job. The organization first has to establish how the attackers got in and whether they are still inside, otherwise it risks rebuilding on top of the same compromise. Every connection to every hospital and practice then has to be checked before it is switched back on. Each of those steps protects patients and partners, and each of them takes time measured in days or weeks, not hours.

Synnovis chose the slowest and safest route. It later said that none of the IT infrastructure affected by the attack remained in use, which implies a rebuild rather than a restoration. It reported restoring access to all of its pre-attack services by late autumn 2024, around five months after the attack. A rebuild removes doubt about hidden attacker access. It also means every interface, every analyzer connection and every result route has to be rebuilt and tested.

Why regions consolidate, and what they give up

The economics of consolidation are real and should not be dismissed. A single large laboratory can run analyzers around the clock rather than leaving them idle overnight. It can buy reagents and equipment at volume. It can concentrate rare specialist skills, such as those needed for complex blood work or tissue diagnosis, where they are fully used. It can standardize on one set of systems instead of several. For a public health system under budget pressure, these are compelling arguments, and the savings come back every single year.

Consolidation as national policy

In England, consolidation has been national policy for nearly two decades. Lord Carter’s reviews of NHS pathology in the 2000s argued for larger, networked services. In 2017 NHS Improvement set out a plan to organize pathology in England into 29 networks, each built around a hub laboratory serving several trusts. Synnovis is one form of that model, with a commercial partner. Other networks are partnerships among NHS trusts alone.

That history matters for the argument here. Trust boards that consolidated were following national direction and national savings targets. The concentration risk was built into a system-wide design. It was never priced at the system level either, and so each network carries its own share of it.

How the pattern differs elsewhere

In the United States the structure differs, but the concentration is similar. Large commercial reference laboratories handle specialized and outsourced testing for thousands of hospitals and physician practices. Many health systems have sold or outsourced their outreach laboratory businesses. Ambulatory networks and independent physician practices often depend on one reference laboratory for nearly all their testing.

The same logic extends beyond the laboratory. Teleradiology groups read images for many hospitals overnight. Revenue cycle and claims platforms process payments for large shares of the market, as the Change Healthcare attack showed. Specialty pharmacy, sterile compounding and dictation services follow the same pattern. Each delivers savings through scale, and each creates a single point that many organizations depend on.

What consolidation gives up is less visible: alternatives. A region that once had several hospital laboratories now has one network, with ordering, results and blood bank records running through shared systems. In normal years, that looks like efficiency. In a bad month, it looks like a single point of failure, a term engineers use for any one component whose loss brings down everything that depends on it.

Suppose a regional health system merges the laboratories of four hospitals into one hub. The business case shows a steady annual saving and is approved. Five years later, the hub’s systems are encrypted by attackers. Each of the four hospitals once had its own laboratory that could have kept going while another was down. Now none does. The saving was real every year. So is the loss, but it arrives all at once, and nobody wrote it into the plan.

Joint ownership does not solve this. The trusts were co-owners of Synnovis, and that gave them a seat at the board, not a fallback laboratory.

The best case for consolidating anyway

The strongest objection to this argument deserves a fair hearing. A large operator can afford security that four small hospital laboratories cannot: a dedicated security team, round-the-clock monitoring, modern systems and a single, well-tested recovery plan. Small, separate laboratories are attacked too, and many have weaker defenses. Consolidation may well reduce the chance of a successful attack even as it raises the cost of one.

That objection is largely right, and it does not reverse the argument. The claim here is not that regions should break up their networks. The claim is that the business case should show both effects: fewer incidents, and larger ones. A decision that shows only the first is incomplete, however sound its conclusion.

Separate laboratories are also less independent than they look. Hospitals that each run their own laboratory may share a software vendor, a network provider or a managed service company. The CrowdStrike software update that crashed Windows machines worldwide in July 2024 showed how a single supplier can fail many independent organizations at once. Real resilience comes from diversity in the things that fail together, not from the number of buildings.

The contract

Long outsourcing contracts for clinical services are written around steady-state performance. They specify turnaround times, availability targets and service credits for missed levels. A service credit is a small discount the supplier owes when it misses an agreed standard. Service credits are built for a bad month of slow results. Against a regional outage measured in weeks, they are close to irrelevant. They return a fraction of the fee and do nothing for patients waiting on results.

The terms that matter in a destructive event are different, and most long contracts are thin on them. They include:

• Restoration priorities. Who decides which services come back first, and how clinical urgency enters that decision.
• Forensic sharing. How fast the supplier must share findings from its investigation that affect the buyer’s own network. Forensics here means the technical detective work of establishing how attackers got in, what they touched and what they took.
• Interim service. What manual service the supplier must staff while systems are down, and at whose cost.
• Reconnection assurance. What evidence the buyer receives before it reconnects interfaces, so that it is not reopening a door to the same attackers.

When those terms are missing, they get negotiated during the incident, by the same people running the response. That is the worst possible time: everyone is exhausted, the clinical pressure is acute, and both sides have every incentive to protect their own position.

Clauses that decide the bad month

Several standard outsourcing terms matter more in a destructive event than their place in the contract suggests. Force majeure clauses excuse performance when events beyond a party’s control intervene. Some suppliers argue that a cyberattack qualifies. Buyers should make sure the contract says an attack does not excuse performance where the supplier failed to meet its own security obligations.

Step-in rights let the buyer take over a failing service, or appoint someone else to run it, for a period. They are common in UK public sector outsourcing. They are only useful if the buyer could realistically exercise them. A step-in right over a laboratory with no alternative system, staff or premises is a right without a remedy.

Recovery objectives state how quickly the supplier must restore each service and how much data it may lose. They are often written as a single figure for the whole service. A useful contract sets different objectives for the transfusion service, urgent hospital testing, routine GP testing and specialist work. It also requires the supplier to show, through tests, that those objectives are achievable.

Notice and information rights set how fast the supplier must tell the buyer of an incident, what it must share, and whether the buyer may see forensic reports. Without them, a buyer may learn more from the press than from its own partner.

A long term adds a second problem. Security expectations in 2021 were not those of 2024, and will not be those of the 2030s. A contract that freezes its security schedule at signing needs a mechanism to raise it: periodic re-baselining, a right to require specific controls, and a price adjustment path so the supplier can fund them. Without that, the buyer’s only lever is renewal, which may be a decade away.

Exit and transition

Long contracts also need a credible exit. After a destructive event, a buyer may decide the partnership cannot continue, or may want to move part of the work elsewhere. Exit clauses usually assume an orderly handover at the end of the term: data returned, staff transferred, systems migrated. They rarely contemplate a handover from a supplier whose systems have just been rebuilt.

A useful exit clause covers partial exit, the transfer of specific services such as transfusion, at any point in the term. It also sets the supplier’s duty to provide data in a usable format and to support the transfer at agreed rates. Without those terms, a buyer that loses confidence in its partner has no practical route out until renewal.

Which rules shape the contract

The regulatory baseline differs by country and by type of organization, and counsel should confirm what applies. In England, suppliers with access to NHS patient data and systems are expected to complete the NHS Data Security and Protection Toolkit, an annual self-assessment against national data security standards. That sets a floor for security. It does not specify restoration times or who pays for an outage.

In the United States, hospitals participating in Medicare must meet emergency preparedness requirements that include plans for continuing operations. Those duties sit with the hospital and do not transfer to its suppliers. A hospital that outsources its laboratory still owns the plan for losing it. The contract is the only place where the supplier’s part of that plan becomes enforceable.

The spare capacity

Consolidation removes alternatives by design. When the single network fails, the fallback is other laboratories with capacity to spare, compatible test catalogs (the menu of tests a laboratory offers and how it names them), transport to move samples, and a way to return results to the right patient record. Such a fallback does not exist by default, and it cannot be built in a week.

Spare capacity has to be bought in uneventful years, which is why it is usually cut. It can take several forms:

• A standing mutual aid agreement with laboratories outside the network, with agreed volumes and prices, so nobody is haggling during a crisis.
• Pre-built order and result interfaces to those laboratories, tested at least annually, even if they carry no daily traffic. An untested backup connection is a hope, not a plan.
• A short list of tests that will be protected in a degraded state, agreed with clinicians in advance, so that the hardest triage decisions are made calmly.
• A plan for data the clinicians lose, such as historical blood group results.

That last point deserves emphasis. The O-type blood appeal showed how a narrow data gap can create a national supply call. Nothing was wrong with the blood or the donors. What was missing was quick access to information that already existed. A small, regularly refreshed copy of critical data held somewhere the attack cannot reach is cheap compared with that outcome.

What it takes to keep a fallback warm

A fallback laboratory is useful only if the work can actually move. Test codes must be mapped, because two laboratories may name and code the same test differently. Reference ranges, the normal values against which a result is judged, can differ between laboratories and analyzers. Clinicians need to know which range applies to a result they did not expect to receive from elsewhere.

Patient identity has to travel too. Results must match the right person in the hospital’s record and the GP’s system, which depends on consistent identifiers. Courier routes and sample stability set hard limits: some samples must be analyzed within hours, so a distant laboratory may be fine for some tests and useless for others.

The maintenance cost is real but modest. Mappings must be updated when either laboratory changes its catalog. Interfaces need a periodic test with real, if small, volumes. A useful annual exercise sends a defined batch of samples down the fallback route and checks every step, from labeling to the result appearing in the right record. The exercise usually finds a broken mapping or an expired certificate, which is exactly its purpose.

The protected data set

The critical data copy should be small and specific. For transfusion, it means blood group and antibody history. For other clinical areas, it may mean recent results for patients on anticoagulants, chemotherapy or dialysis, where decisions depend on trends. Many electronic patient record vendors offer downtime viewers that keep recent clinical information on standalone machines. Laboratory data can follow the same pattern.

Two design rules matter. The copy must be isolated from the systems it backs up, or the same attack will reach it. And it must be refreshed often enough to be clinically safe. A copy that is a month old may still answer most blood group questions. It will not show last week’s antibody finding.

In budget terms, this capacity looks like duplication, and finance teams are trained to remove duplication. It is better understood as an option premium. In finance, an option is the right, but not the obligation, to do something later; you pay a small fee now to keep that right open. Here the buyer pays a modest, predictable amount each year for the right to move urgent work elsewhere at short notice. Whether that premium is worth paying depends on the cost of the event it hedges, which brings us to the third decision.

The loss allocation

An event like Synnovis spreads costs widely. The supplier pays for forensics, rebuilding and its own lost revenue. The hospitals absorb postponed operations and outpatient clinics, overtime, agency staff and the cost of running manual processes. GP practices and patients absorb delay. Some of that delay causes clinical harm, which carries its own legal and human cost.

Outsourcing contracts allocate only a small slice of this. Liability is commonly capped at a multiple of annual fees, meaning the supplier’s total responsibility cannot exceed a set amount however large the damage. Consequential losses, the knock-on costs such as cancelled operations and lost income rather than the direct cost of the failed service, are often excluded outright.

Where each cost lands

The costs fall into distinct groups, and each lands on a different party. The supplier bears incident response, rebuilding and its own lost income. The hospitals bear lost elective activity, extra staffing, backlog clearance and the management time of running a critical incident. Primary care bears delayed diagnosis and extra workload. Patients bear delay and, in some cases, harm.

Clinical harm has its own route. In England, clinical negligence claims against NHS trusts are generally handled through NHS Resolution’s Clinical Negligence Scheme for Trusts. A claim arising from a delayed result would normally be brought against the trust that treated the patient. Any recovery from the supplier would depend on the contract’s indemnities and caps.

Notification costs land unevenly too. Where stolen data includes patient information, the organizations that control that data, often the hospitals and practices, carry the duty to assess and, where required, notify. A supplier’s forensic findings may take many months. Until then, controllers cannot complete their own assessments.

Insurance does not fill the gap as neatly as boards assume. The supplier’s cyber insurance has limits, sublimits (smaller caps on particular types of loss) and exclusions, and responds to the supplier’s losses first. The buyer’s own cover may treat a supplier outage as a contingent business interruption event, meaning lost income caused by someone else’s failure rather than your own, with its own sublimit, if it covers it at all. The result is that most of the loss sits with the buyer and its patients, uninsured and unbudgeted.

When the state becomes the insurer of last resort

Public health systems often end up carrying losses no contract assigned. NHS trusts draw on national funding arrangements and support when activity collapses. In the United States, after the Change Healthcare attack, the Centers for Medicare & Medicaid Services offered accelerated payments to affected providers whose cash flow had stopped. UnitedHealth also offered temporary funding to providers.

Such support is welcome, but it is not a plan. It arrives at the government’s or the supplier’s discretion, on their terms. It also hides the true cost of concentration from the people who chose it. A loss absorbed centrally never appears in the next consolidation business case.

The honest procurement response is to estimate the loss. A hospital finance team can model a four-to-six-week loss of pathology: cancelled elective activity, outpatient slots, extra staffing and recovery backlog. That figure should sit next to the annual savings in the business case. It then sets three numbers:

1. The size of the option premium worth paying for spare capacity.
2. The liability cap and insurance requirement worth negotiating.
3. The residual risk the board knowingly accepts.

Building the estimate

The model does not need precision to be useful. Its inputs already exist in most finance departments: weekly elective and outpatient activity that depends on pathology, the income or cost associated with that activity, premium staffing rates and the cost of extra sessions to clear a backlog. Scenarios of two, six and twelve weeks show how the loss grows with duration.

Clinicians should mark which activity continues on manual working and which stops. Finance should mark which costs are recoverable from the supplier under the contract, which are insured and which are not. The final column, the uninsured and unrecoverable loss, is the number the board is being asked to accept. Most boards have never seen it.

Who should own the number

The estimate needs an owner, or it will be produced once and forgotten. A natural pairing is the chief financial officer with the chief medical officer, because the model joins income and clinical judgment. It belongs on the risk register, next to the supplier’s name, and should go to the board’s audit or risk committee with each contract review.

It should also be refreshed when something material changes. Examples include a new service added to the partnership, a change in the supplier’s ownership, an insurance renewal or a serious incident at a comparable supplier. Each of those changes the probability, the size of the loss or who would carry it.

US health systems with outsourced or joint-venture laboratory, imaging and pharmacy services face the same arithmetic. A HIPAA business associate agreement, the contract US privacy law requires when a supplier handles patient information on a provider’s behalf, governs protected health information, and says nothing about restoring service. It answers “who protects the data?” and not “who keeps the lights on?” Organizations should check with counsel how indemnity, caps and insurance in their agreements would respond to a prolonged outage.

Pricing the bad month before signing

A well-run consolidation does not avoid concentration; it prices it. Take a county health system preparing to renew a laboratory partnership. Its business case has two columns. One shows the annual savings. The other shows a modeled multi-week loss of the service, built with clinicians and finance together. The board reads both, debates them, and records which risk it is choosing to keep. The contract includes destructive-event terms and a schedule for raising security requirements. A mutual aid agreement with a neighboring laboratory is signed, its interfaces are tested every year, and a protected-test list is part of the incident plan.

How it differs by type of organization

An NHS trust in a pathology network shares the decision with other trusts and with national bodies. Its influence over the contract may be limited, but it can insist that the network’s business case shows the bad month and that its own continuity plan covers the network’s failure.

A large US health system with a laboratory joint venture has more contractual freedom and more to lose. It should treat the joint venture like any critical supplier, with destructive-event terms, despite owning part of it. An ambulatory network or physician group that sends its testing to one reference laboratory has the least bargaining power. Its best protection is a pre-arranged second laboratory for urgent work and a tested way to receive results from it.

A county or public hospital faces procurement rules that make mid-term changes slow. That argues for building flexibility into the original tender: options to add security requirements, test fallbacks and adjust price without reopening the whole contract.

The usual failures are mirror images of that:

• Counting only the good years. Treating the rare outage as too unlikely to model, so it never appears next to the savings.
• Relying on service credits. Assuming the contract’s penalty regime will compensate for a disaster it was never designed for.
• Treating ownership as control. Believing that a board seat in a joint venture is the same as a fallback.
• Cutting the “duplicate” capacity. Removing backup arrangements in a tight budget year because they carry no daily traffic.
• Assuming insurance will respond. Never checking whether a supplier outage falls within your own policy, and at what sublimit.

These are not technology failures. Each is a decision about money and risk, made by executives, often years earlier.

Before the partnership comes up for renewal

• Which of our critical services now depend on a single supplier or a single shared system, and what happens to patients or customers if it is gone for a month?
• Does the business case for each consolidated service show a modeled bad month next to the annual savings? Who signed off on the residual risk?
• If a key supplier were hit by ransomware tomorrow, who decides what gets restored first, is that written into the contract, how quickly must the supplier tell us what the attackers did, and what proof do we need before we reconnect our systems to theirs?
• Where would urgent work go if our main partner went dark? When did we last test that route end to end?
• What is the supplier’s liability cap, are consequential losses excluded, and does our own insurance cover a supplier outage? What is the sublimit?

The answers may be uncomfortable. The questions cost very little to ask in a calm year and a great deal to discover in a crisis. Ask them before signing, ask them again at each contract review, and ask them out loud at the board.

With hindsight

The scale of the event became clearer over the following year. NHS England’s tallies put postponements above 10,000 outpatient appointments and 1,700 elective procedures. Each of those numbers is a person whose care was delayed: a clinic visit moved, an operation rescheduled, a diagnosis left waiting.

Service came back slowly. Synnovis reported restoring access to all of the services it had offered before the attack by late autumn 2024, about five months on. It said that none of the affected IT infrastructure remained, which describes a rebuild rather than a repair. For five months, then, the region ran on reduced, rerouted and partly manual pathology.

When the UK government set out its planned cyber legislation in April 2025, it put the estimated cost of the attack at £32.7 million. That figure is worth reading alongside the original argument for consolidation. Savings from pooling a region’s pathology arrive steadily, year after year. A loss of this size arrives in a single blow, and it does not land neatly on the party that made the savings.

The government’s later factsheet on critical suppliers described the figure as the company’s own estimate of its losses. That detail matters. The £32.7 million is the supplier’s side of the ledger. The hospitals’ lost activity, the extra staffing, the GP workload and the harm to patients sit outside it, and no public figure adds them up.

The human cost was confirmed in June 2025, when King’s College Hospital said a patient’s death had been linked to the attack, with a long wait for a blood test result identified as one contributing factor. For boards, this is the hardest part of the story to look at, and the most important. Cyber risk in clinical services is a patient safety risk as well as a data and financial one, and it should be governed like one.

Synnovis completed its forensic review in 2025 and finished notifying the affected organizations by the end of November that year. That timeline is a reminder of how long the tail of an attack can be. Understanding what was taken, and telling everyone affected, took well over a year after the systems first went down.

A later update said Synnovis would not contact affected patients directly. The duty to decide what to tell patients passed to the organizations whose data had been taken. This was loss allocation in another form: the supplier carried the investigation, and the hospitals and practices carried the conversation with patients.

Policy moved slowly toward suppliers. In November 2025 the UK government introduced the Cyber Security and Resilience Bill, which would bring managed service providers, companies that run technology services on behalf of other organizations, into the network and information systems regime, the UK’s existing framework of security duties for essential services.

The bill also lets regulators designate critical suppliers to essential services. Its factsheet used Synnovis as the case study. The designation conditions ask whether a supplier’s failure would disrupt an essential service with significant impact, and whether its goods or services could realistically be sourced elsewhere. That second question is the concentration problem written into law. Designated suppliers would face security duties and enforcement, and regulated entities would have to report significant incidents within 24 hours, with a fuller report at 72 hours.

The American comparison grew starker too. Change Healthcare’s breach was later reported to federal regulators as affecting about 190 million people, the largest health data breach reported in the United States. Its cost fell on providers, patients and the parent company in proportions no contract had set out in advance.

In the United States, the Department of Health and Human Services proposed in January 2025 to update the HIPAA Security Rule. The proposal included requirements for business associates to notify covered entities within 24 hours of activating their contingency plans. It was a proposal, and it addresses notice rather than who pays.

What held up from the original argument is the asymmetry between steady savings and a single, large loss that lands on others. What the public record still lacks, more than two years on, is a full accounting of the buyers’ side. The only widely cited cost figure remains the supplier’s own.

Legislation addresses the supplier’s security. It does not change who carries the loss when a consolidated service fails. That still depends on the contract, the spare capacity bought around it, and whether the business case priced the bad month alongside the good years. The practical conclusion holds in health care and beyond: when you concentrate a critical service to save money, put the cost of losing it on the same page as the savings, and decide on purpose who will carry it.