NHS and health-sector breach statistics: ICO incident reports, disruption after the Synnovis and Advanced supplier attacks, and the historical WannaCry findings. The figures distinguish reported breaches, postponed care and regulatory penalties.
Health-sector incident reports cover more than the NHS. This page uses the ICO’s published incident data and primary NHS, government and regulatory sources for selected cases. These measures describe different consequences and cannot be combined into a single NHS breach total.
This page brings those figures together and is scoped to the health sector: the ICO health-sector share, the two named NHS-supplier incidents (Synnovis in 2024 and Advanced in 2022), their patient-safety impact, and the 2017 WannaCry baseline. Every figure carries its data period, and every source is linked in full at the end.
Key facts and figures
- 647 health-sector incidents appear in the ICO’s October–December 2025 dataset, the largest sector count in that quarter; this is not an NHS-only total.
- 10,152 acute outpatient appointments were postponed at the two most affected trusts during the Synnovis disruption in 2024.
- 1,710 elective procedures were also postponed at those trusts in the NHS England recovery statement.
- 1 patient’s death was described by the government as having been contributed to by the Synnovis attack, in its November 2025 statement.
- £32.7 million was the estimated financial impact on Synnovis cited in the government’s November 2025 statement.
- £3,076,320 was the final ICO penalty agreed with Advanced in March 2025 following its 2022 ransomware incident.
- 79,404 people were recorded as having personal data taken in the Advanced incident; the penalty notice notes possible remaining duplicates.
- 81 of 236 NHS trusts in England were affected by WannaCry in May 2017; NHS England estimated more than 19,000 cancelled appointments.
Checked on 15 October 2026. ICO sector figures cover October–December 2025. The named incidents are dated historical case studies, not an annual NHS total. Postponed appointments, affected people, safety incidents and costs use different units.
Which sector reports the most data breaches to the ICO?
In October–December 2025, the ICO dataset contains 647 distinct health-sector incident references, compared with 518 in education and childcare, 395 in retail and manufacturing, and 298 in finance, insurance and credit. Health had the largest count in that quarter. Repeated rows for different data types or affected groups have been deduplicated by incident reference.
The category includes organisations beyond the NHS. Reporting volumes depend on organisational activity, detection and reporting behaviour, and there is no common exposure denominator here. The ranking therefore does not establish that healthcare has the highest breach rate or explain why it reports more incidents.
The related data-breach guide compares sectors and cyber categories. Non-cyber incidents should not automatically be labelled staff errors: the dataset includes other causes and unspecified categories. This page uses the health category only as context for the separately documented NHS cases.
What major NHS cyber incidents are documented?
The Synnovis ransomware attack began on 3 June 2024 and disrupted pathology services used by NHS organisations. The government’s November 2025 statement records disruption at five trusts and local care providers, delays to more than 11,000 appointments and procedures, and a contribution to one patient’s death. These serious consequences do not provide a consistent basis for ranking every NHS incident.
WannaCry, Synnovis and Advanced illustrate different types of disruption. The table presents documented effects rather than claiming that one was the largest on every measure. Supplier incidents can affect multiple healthcare organisations through shared services.
| Incident | When | What happened | Headline patient impact |
|---|---|---|---|
| Synnovis (pathology supplier) | 3 June 2024 | Ransomware disrupted pathology services used by NHS organisations | 10,152 outpatient appointments and 1,710 elective procedures postponed at two trusts; government later cited a contribution to one death |
| Advanced (software supplier) | August 2022 | Ransomware accessed systems through a customer account without MFA | NHS 111 and access to records disrupted; personal data taken, with 79,404 affected people recorded |
| WannaCry | May 2017 | Global worm exploiting unpatched Windows systems | At least 81 of 236 English trusts affected; over 19,000 cancelled appointments estimated |
Synnovis and Advanced demonstrate how disruption at a supplier can affect healthcare delivery. They do not establish what proportion of health-sector cyber incidents originate with suppliers. Wider ransomware statistics use different samples and definitions.
How many NHS appointments were cancelled by the Synnovis cyber attack?
NHS England’s 2024 recovery statement recorded 10,152 postponed acute outpatient appointments and 1,710 elective procedures at King’s College Hospital and Guy’s and St Thomas’. Together that is 11,862 items of activity, not necessarily distinct patients. The later government description of more than 11,000 is a rounded summary, not evidence that this total increased.
The recovery statement explains that disruption to blood-transfusion laboratory systems meant the trusts could not perform their normal cross-matching and relied on O-type blood. It reported the restoration of those systems and a return to issuing all blood groups. The documented effect concerns those services and period; it should not be generalised to every clinical decision.
How many patients were harmed by the Synnovis attack?
Service disruption and patient harm require different measures. Postponed activity does not by itself identify the number of people harmed, and one person may have several affected appointments. The government’s November 2025 statement provides a clear account of the serious patient-safety consequences without a complete national harm total.
That government statement says the Synnovis attack contributed to the death of a patient. A contributing factor is not necessarily the sole cause. This page does not claim an independently established first-ever UK cyber-related death or infer a total death toll from one case.
King’s College Hospital’s 10 November 2025 update confirmed that Synnovis had reported stolen data and that the trust was assessing the affected information. It said systems had recovered and that affected individuals would be notified where appropriate. Attacker claims about file volumes or ransom demands are not treated here as verified measures of patient exposure.
How much did the Synnovis attack cost?
The government’s November 2025 written statement put the financial impact on Synnovis at an estimated £32.7 million. It did not present this as the total cost to the NHS, every affected provider or patients. Different cost estimates need the same scope and accounting period before comparison.
Supplier costs, healthcare-provider recovery costs and lost clinical activity are distinct measures that may overlap. Neither the £32.7 million estimate nor the appointment count supplies a complete valuation of the incident’s consequences.
What was the ICO fine for the Advanced NHS breach?
On 27 March 2025, the ICO announced a final £3,076,320 penalty against Advanced following a voluntary settlement, reduced from a provisional £6.09 million. The case concerned its health and care subsidiary’s processing of personal information for customers. Processors already had direct UK GDPR obligations; the case applied those duties rather than creating them.
The ICO found that data was taken in the August 2022 incident, including entry information for the homes of 890 people receiving care. It reported 79,404 affected people, with possible duplicates noted in the penalty notice. Findings included incomplete MFA coverage, inadequate patch management and insufficient vulnerability scanning; reducing the case to one missing control would omit relevant failures.
The case illustrates both processor security obligations and risks to dependent services. Personal-data breach reporting depends on the legal risk threshold; a controller must notify the ICO unless the breach is unlikely to pose a risk to people’s rights and freedoms. Operational incident and regulatory reporting measures should remain distinct.
How bad was the WannaCry attack on the NHS?
The NAO’s October 2017 investigation found at least 81 of 236 NHS trusts in England affected by WannaCry, plus 603 infected primary care and other NHS organisations, including 595 GP practices. The 236 figure is the total trust population, not the number affected. NHS England identified 6,912 cancelled appointments between 12 and 18 May and estimated that the total exceeded 19,000.
A later DHSC assessment, confirmed in an October 2018 parliamentary answer, estimated £92 million in lost output and IT costs. This was not a cost established in the original NAO investigation. The NAO identified unpatched or unsupported Windows systems and firewall protection as relevant to infection; that finding should not be assumed to explain the separate Synnovis incident.
Frequently asked questions
What major NHS cyber incidents are documented?
Synnovis disrupted pathology services and led to 10,152 outpatient appointments and 1,710 elective procedures being postponed at two trusts in 2024. Advanced’s 2022 incident led to a £3,076,320 final penalty. WannaCry affected at least 81 of 236 English NHS trusts in 2017. Their different effects do not support a single overall ranking.
How many NHS appointments were cancelled by the Synnovis cyber attack?
NHS England’s recovery statement recorded 10,152 acute outpatient appointments and 1,710 elective procedures postponed at the two most affected trusts. The combined 11,862 figure is activity, not necessarily unique patients. A later description of more than 11,000 is a rounded summary rather than proof of an increase.
Has anyone died because of an NHS cyber attack?
The government’s November 2025 statement says the Synnovis attack contributed to a patient’s death. This describes a contributing factor and does not establish that the attack was the sole cause or provide a complete count of deaths linked to cyber incidents.
Which sector reports the most data breaches to the ICO?
Health had the largest count in the ICO’s October–December 2025 incident dataset, at 647 distinct references. The category is wider than the NHS and describes reported incidents, not the rate of breaches per organisation or patient.
What was the ICO fine for the Advanced NHS breach?
The final fine was £3,076,320, announced on 27 March 2025 after a voluntary settlement, reduced from a provisional £6.09 million. The ICO found inadequate security including incomplete MFA, patching and vulnerability-scanning arrangements. Personal data was taken in the 2022 incident, with 79,404 people recorded as affected.
Related guides
- Data Breach Statistics UK: ICO Reports, Trends & Costs
- Ransomware Statistics UK: Attacks, Payments & Costs
- GDPR Fines UK: ICO Fine & Enforcement Statistics
- Human Error Data Breach Statistics: What the ICO Data Shows
- GDPR data breach: what to do in the first 72 hours
Sources & references
- ICO — Data Security Incident Trends, Q4 2025, distinct incident references
- NHS England London — Synnovis recovery statement and postponed activity, 2024
- UK Government — written statement HCWS 1046, November 2025
- King’s College Hospital — Synnovis data-breach update, 10 November 2025
- ICO — Advanced final fine and findings, 27 March 2025
- ICO — Advanced monetary penalty notice, affected data and security findings
- National Audit Office — WannaCry investigation, 27 October 2017
- UK Government — DHSC estimate of WannaCry costs, October 2018
Most NHS and supplier breaches trace back to everyday failures — a missed patch, a single account without MFA, a mishandled record. Train your team to handle personal data safely and meet UK GDPR duties.
Explore the GDPR & Data Protection Course →
Mark writes about data protection, workplace compliance and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.