Guy's and St Thomas'​ NHS Foundation Trust Vendor Cyber Rating & Cyber Score

Incident Types: The types of cybersecurity incidents that have occurred include Cyber Attack and Ransomware.

Detection and Response: The company detects and responds to cybersecurity incidents through an law enforcement notified with national crime agency (nca), national cyber security centre (ncsc), information commissioner’s office (ico), and containment measures with system encryption, data exfiltration prevention (post-breach), and remediation measures with rebuilt 75+ applications, migrated core systems to the cloud, restored 65+ scientific analyzers, and recovery measures with full recovery estimated to take months, ongoing as of november 2024, and communication strategy with notifications to affected organizations completed by november 21, 2025; individual patient notifications to be determined by nhs trusts, and third party assistance with national cyber security centre (ncsc), cybersecurity experts..

Common Attack Types: The most common types of attacks the company has faced is Ransomware.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Blood Test Results, Hiv/Sti Diagnoses, Cancer Screenings, Personally Identifiable Information and .

Third-Party Assistance: The company involves third-party assistance in incident response through National Cyber Security Centre (NCSC), cybersecurity experts.

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Rebuilt 75+ applications, migrated core systems to the cloud, restored 65+ scientific analyzers.

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by system encryption and data exfiltration prevention (post-breach).

Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Full recovery estimated to take months, ongoing as of November 2024.

Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Authorities considering retaliatory action against Qilin.

Key Lessons Learned: The key lessons learned from past incidents are Vulnerability of critical healthcare infrastructure to third-party service provider attacks; challenges in identifying and notifying affected individuals due to random data exfiltration; importance of robust incident response and recovery plans.Healthcare remains a prime target for cybercriminals due to underinvestment in IT security and the urgency of restoring critical services.

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Enhance cybersecurity measures for third-party vendors; improve data protection and encryption; develop clearer protocols for patient notifications in large-scale breaches; invest in zero-day vulnerability detection and mitigation..

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: BBC, and Source: Synnovis incident reports, and Source: NHS cyber incident records, and Source: News Article.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Notifications to affected organizations completed by November 21 and 2025; individual patient notifications to be determined by NHS trusts.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were NHS trusts advised to determine patient notifications; Synnovis warnings about potential scam communications and Patients advised to verify communications from NHS trusts regarding the breach.

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as National Cyber Security Centre (NCSC), cybersecurity experts.

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Replaced all compromised IT infrastructure; developed custom systems to reconstruct data; enhanced security protocols for future incidents.

Ransom Payment History: The company has Paid ransoms in the past.

Last Ransom Demanded: The amount of the last ransom demanded was $50 million.

Last Attacking Group: The attacking group in the last incident were an Qilin and Qilin group.

Most Recent Incident Detected: The most recent incident detected was on 2024-06-03.

Most Significant Data Compromised: The most significant data compromised in an incident were 400GB of data exfiltrated and including 300 million patient interactions.

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was National Cyber Security Centre (NCSC), cybersecurity experts.

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were System encryption and data exfiltration prevention (post-breach).

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were 400GB of data exfiltrated and including 300 million patient interactions.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 300.0M.

Highest Ransom Demanded: The highest ransom demanded in a ransomware incident was $50 million.

Highest Ransom Paid: The highest ransom paid in a ransomware incident was No.

Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Authorities considering retaliatory action against Qilin.

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Vulnerability of critical healthcare infrastructure to third-party service provider attacks; challenges in identifying and notifying affected individuals due to random data exfiltration; importance of robust incident response and recovery plans., Healthcare remains a prime target for cybercriminals due to underinvestment in IT security and the urgency of restoring critical services.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Enhance cybersecurity measures for third-party vendors; improve data protection and encryption; develop clearer protocols for patient notifications in large-scale breaches; invest in zero-day vulnerability detection and mitigation..

Most Recent Source: The most recent source of information about an incident are NHS cyber incident records, Synnovis incident reports, BBC and News Article.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (17-month forensic review completed, notifications sent to affected organizations).

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was NHS trusts advised to determine patient notifications; Synnovis warnings about potential scam communications, .

Most Recent Customer Advisory: The most recent customer advisory issued was an Patients advised to verify communications from NHS trusts regarding the breach.

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Exploitation of zero-day vulnerability (claimed); lack of robust third-party vendor security measures, Underinvestment in IT security, healthcare as a high-value target.

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Replaced all compromised IT infrastructure; developed custom systems to reconstruct data; enhanced security protocols for future incidents.