Police arrest Qilin ransomware suspect on holiday, as links made to Synnovis hack that contributed to patient’s death
A 28-year-old Russian man has been arrested by German police, suspected of being a key member of the Qilin ransomware gang. As BBC News reports, detectives have linked the man to the 2024 attack against blood-testing firm Synnovis, that disrupted London hospitals, and resulted in the death of a patient.
The suspect, who has been named by German media only as “Vladimir K” was originally detained in May in Japan, after he travelled there on holiday. According to German officials, the man’s vacation plans were intercepted and Japanese police were waiting for him on arrival. Earlier this month he was extradited to Germany.
Germany’s interest in “Vladimir K” is related to a cyber attack in September 2024, which saw around US $160,000 worth of cryptocurrency extorted from a logistics firm. According to the BBC, German detectives have now included in their investigation possible links to the June 2024 attack which saw the Qilin ransomware group disrupting pathology services at various London hospitals, and resulted in the cancellation of operations and outpatient appointments.
The incident is said to have crippled Synnovis’s IT systems, and caused a critical shortage of O-type blood in hospitals. A subsequent probe into the attack by King’s College Hospital NHS Foundation Trust confirmed that a patient died in part due to blood test results being delayed.
As a consequence, British police are reportedly examining whether their own inquiry could lead to a charge of unlawful killing.
No ransom was paid by Synnovis, a decision the firm made jointly with the NHS trusts to which it provides services.
Ransomware gangs have been accused of causing deaths in the past. For instance, in 2020 a different gang disrupted systems at a Düsseldorf hospital and caused a seriously-ill woman to be diverted to another health facility 30 km away.
According to reports, as a result of the attack doctors were not able to start treating the patient for an hour and she died.
The Qilin ransomware-as-a-service (RaaS) group has been operating since at least 2022, and has reportedly hacked more than 4000 organisations, and extorted over US $140 million. High profile victims include Japanese beer-maker Asahi, potentially exposing the data of more than 1.5 million customers and around 275,000 current and former employees and their families.
About Author
