German police arrest Russian man linked to Qilin ransomware and Synnovis hospital attack
Authorities detained a suspect in Japan and extradited him to Germany. He is tied to the cyberattack that disrupted London hospitals and contributed to a patient death.
Key points
- A 28-year-old Russian man was extradited to Germany after being detained in Japan.
- German investigators linked him to the Qilin ransomware group and the Synnovis breach.
- The June 2024 attack caused blood shortages in London and resulted in one patient death.
German authorities have arrested a 28-year-old Russian national suspected of being a key member of the Qilin ransomware gang. Police extradited the man, identified in German media as Vladimir K, from Japan earlier this month after intercepting him during a holiday.
Investigators believe the suspect played a central role in cyber operations involving Qilin. According to BBC News, German detectives linked him to the September 2024 extortion of US $160,000 from a logistics firm. They are now expanding their probe to include the June 2024 attack on Synnovis, a blood-testing company serving London hospitals.
Investigation and Extradition Details
The suspect was originally detained in May in Japan. German officials stated that Japanese police had been waiting for his arrival to execute the arrest. His vacation plans were intercepted, leading to his transfer to Germany for further questioning and legal proceedings regarding the cybercrimes.
Impact on Healthcare Services
The Qilin attack crippled Synnovis’s IT systems in June 2024. This disruption disrupted pathology services across various London hospitals, forcing the cancellation of operations and outpatient appointments. A critical shortage of O-type blood occurred because test results were delayed.
King's College Hospital NHS Foundation Trust confirmed that a patient died partly due to these delays. British police are reportedly examining whether the inquiry could lead to a charge of unlawful killing. Synnovis and the NHS trusts jointly decided not to pay the ransom.
Background on Qilin Ransomware
The Qilin ransomware-as-a-service group has operated since at least 2022. It has reportedly hacked more than 4,000 organizations and extorted over US $140 million. High-profile victims include Japanese beer-maker Asahi, where the breach potentially exposed data for 1.5 million customers and 275,000 employees.
Ransomware attacks on healthcare have caused fatalities before. In 2020, a different gang disrupted a Düsseldorf hospital, diverting a seriously ill woman 30 km away. Doctors could not treat her for an hour, and she died. This highlights the severe risks of such cyber incidents on critical care.
What should you do?
Security teams should monitor threat intelligence feeds for updates on Qilin tactics. Review access controls for critical healthcare and logistics IT systems. Ensure incident response plans include protocols for potential service disruptions. Watch for official statements from law enforcement regarding new indictments or extraditions related to this group.
Background: Threat intelligence program
A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.
Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats
What to do and how to stay safe: Qilin ransomware
- Monitor official law enforcement announcements for updates on suspect identities and linked crimes.
- Audit third-party vendor security practices, especially for critical service providers like labs or logistics.
- Ensure incident response plans address scenarios where external service disruptions impact patient care.
- Review data backups and recovery procedures to minimize downtime during potential ransomware events.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Was the ransom paid in the Synnovis attack?
No, Synnovis and the NHS trusts jointly decided not to pay the ransom demanded by the attackers.
How did the patient die in the Synnovis case?
A probe confirmed the patient died partly because blood test results were delayed due to the cyberattack.
Where was the suspect arrested?
The suspect was detained in Japan in May and later extradited to Germany for questioning by police.
