Publisher Health

A 14-year-old boy with cancer is among hundreds of hospital patients whose medical procedures have been postponed following a cyber-attack on an NHS provider.

Dylan Kjorstad was scheduled to have a tumour on his ribs removed on 6 June at London’s Royal Brompton Hospital, but the operation has been put back due to concerns about delays in blood supplies.

A ransomware attack on the blood-testing firm Synnovis on 3 June led to disruption to clinical procedures at several London hospitals because the hack meant the company was unable to share information matching blood supplies to patients.

Dylan’s father, John Kjorstad, told the BBC his son’s condition was “very serious” said it would be “dreadful” if his chances of recovery were put at risk by the delay.

Dylan, from Hemel Hempstead in Hertfordshire, was diagnosed with Ewing sarcoma – a type of bone cancer – in January.

Since his diagnosis, Dylan has been undergoing two cycles of chemotherapy every month with the aim of shrinking the tumour ahead of surgery.

But two days before the operation, Mr Kjorstad received a call from the Royal Brompton notifying him that surgery would have to be postponed.

“It was one of those moments where you’re trying to process what’s being told to you. It was disbelief,” he told the BBC.

“It’s such an important, major, surgery, and the person on the other end of the phone – who was very kind and polite – said the reason that it’s been cancelled is because of an IT pathology issue.”

The Royal Brompton Hospital has confirmed the surgery was postponed as a result of the cyber-attack. The operation has been rescheduled to early July, the trust said.

“Our concern would be then if his surgery is postponed further. What will the impact be on his treatment, and the tumour?

Mr Kjorstad said Dylan and his family wanted to get back to normal life.

“We were really hoping that his treatment would be finished by September, so that he can get back to school and resume his education.”

“It’s a very difficult time, as you can imagine.”

Care at several hospital trusts has been disrupted by the ransomware attack on Synnovis by Russian cyber-criminal gang Qilin, in an attempt to extort money from the firm.

The attack – which is being investigated by the National Crime Agency and National Cyber Security Centre – meant blood tests and information-sharing could not be carried out using the normal computerised systems.

It meant specific blood types could not be matched at the usual frequency.

Those worst impacted are four London hospitals in the King’s College Hospital NHS Foundation Trust and Guy’s and St Thomas’ NHS Foundation Trust, where 134 planned procedures, including more than 180 cancer surgeries, have been postponed since 3 June.

A further 2,194 outpatient appointments have also been postponed, and 64 organs had to be re-diverted for use by other NHS trusts.

One hospital doctor told BBC London that blood tests that once would have taken an hour were taking up to six hours.

Last week, an appeal was launched for O-type blood donors, as this is suitable for any patient to receive in an emergency.

Dr Chris Streather, medical director for NHS London, said the hack was “continuing to have a significant impact” on some NHS services.

“Having treatment postponed is distressing for patients and their families, and I would like to apologise to any patient who has been impacted by the incident.”

“Staff are continuing to work hard to re-arrange appointments and treatments as quickly as possible,” he added.

Overnight on Thursday, Qilin shared almost 400GB of the private information on their darknet site.

Mr Kjorstad said he thought it was “sad” that vulnerable NHS patients were suffering as a result of the attack.

“We’re helpless against the perpetrators of these things because they sit in jurisdictions where normal law enforcement activity doesn’t seem to be able to get to them.

“And it’s just really sad to me that it happens to to the most vulnerable people – the people who are seeking, and needing, healthcare.”

NHS England said people should continue to attend appointments unless they are told otherwise.