Saif Abed, founding partner and director of cyber security advisory services at The AbedGraham Group (Credit: Jordan Sollof)
A cyber security expert has called for a public inquiry into the Synnovis ransomware attack which led to at least one patient death.
Speaking at the Healthcare Excellence Through Technology (HETT) 2025 conference in London, Saif Abed, founding partner at the AbedGraham Group, urged NHS leaders to write to MPs requesting an investigation into NHS cyber security and patient safety following the critical incident.
He said that there had been “no culpable intervention at a political level” in the aftermath of the June 2024 attack, which disrupted pathology services in London and led to 10,152 acute outpatient appointments and 1,710 elective procedures being postponed.
“One has to question why this is. And a year later after the attack, we have this proclamation that the attack was associated with a patient death. Now that is a total underestimate,” he said.
Abed argued that the lack of a standardised way of measuring patient harm during a cyber attack “saw the message change throughout the next 12 months” following the Synnovis incident.
“First it was there were low levels of harm, then there were a few examples of moderate levels of harm, then there were a few examples of severe harm, culminating in one example of a contribution to patient death.
“You cannot convince me that there was a standardised methodology in attempting to figure all of this out,” he told the audience.
Abed described “the total lack of oversight” of the NHS supply chain, as “broken”.
“It is clear as day that cyber attacks across all sectors of the UK are underreported, but especially in the NHS,” he said.
He added that a “lack of political leadership” and “lack of political championing and appropriate legislation and regulation”, are causing NHS cybersecurity to be “stuck in a doom loop”.
Both the attack and the response to it from political leaders are “systemic of wider issues, of wider malaise, a wider lack of political will and wider lack of political capability to address these core issues,” he said.
Meanwhile in a session on ‘Future-proofing cyber in health and care’ at HETT, Mike Fell, executive director of national cyber security operations at NHS England, said that transparency around NHS cyber attacks had improved and is “a strength when done responsibly”.
“Transparency has two aspects.
“First, response: At certain stages of an incident, ambiguity is high and ill‑judged transparency can make things worse, so avoid speculation and stick to confirmed facts, respecting legal/privacy obligations.
“Second, learning: share information post‑incident to improve collectively while protecting patients,” Fell said.
He added that a cyber security “virtual grab bag” of guidance will be made available to help non-cyber professionals during incidents, including “standardised agendas, lines to take, lessons from experience, tips about when to act and the kind of things to go through”.
The resource will be available through national Cyber Security Operations services and the Local Government Association has a version on its website, Fell said.
Digital Health News contacted the Department of Health and Social Care for comment.