A Qilin Suspect Is in German Custody. UK Police Are Weighing an Unlawful-Killing Case Over Synnovis.

01 The arrest, and what is still only alleged

German media name the man only as Vladimir K. He flew to Japan on holiday, and German officials said Japanese police were waiting for him when he arrived [ Bitdefender 2026 ] . SecurityWeek put the handover to German authorities at 2 October 2026. Heise called the transfer surprising, because Japan and Germany have no extradition treaty [ Cybernews 2026 ] .

The German case began with a smaller attack. In September 2024, someone encrypted the systems of a German logistics company and extorted more than $160,000 in cryptocurrency. That is the offence Germany first wanted him for. Synnovis came later, as an extra line of inquiry.

Keep the two apart when you read the headlines. Qilin is a ransomware-as-a-service operation. Its core team builds and runs the malware and the leak site. Affiliates break into victims and share the ransom. Qilin was blamed for Synnovis in 2024. Whether this suspect had any hand in that intrusion is exactly what investigators are now trying to establish. No public evidence answers it yet.

02 Why an unlawful-killing case would be new

In June 2025, King’s College Hospital NHS Foundation Trust confirmed that “one patient sadly died unexpectedly during the cyberattack”. Its safety investigation listed several contributing factors. One was a long wait for a blood test result caused by the attack [ The Record 2025 ] . The trust gave no further detail, citing patient confidentiality.

The BBC’s Joe Tidy reports that British police are examining whether their inquiry may lead to an unlawful-killing case, potentially a world first in cyber crime. No charge has been brought, and police have not said who such a case would be against.

Germany has been here before. In 2020 a ransomware attack disrupted a hospital in Düsseldorf. A seriously ill woman was diverted to a hospital about 30 km away, treatment was delayed by an hour, and she died [ Bitdefender 2026 ] . Synnovis differs in one respect. An NHS trust wrote the link into its own safety investigation.

For a UK supplier’s board, the trust’s finding is already the precedent, whatever happens in court. An NHS trust has formally recorded that a supplier’s outage was one of the reasons a patient died. Expect the trusts you sell to to ask you about it.

03 What Synnovis cost London

The attack began on 3 June 2024. Synnovis, a partnership between SYNLAB and two NHS trusts, ran pathology for King’s College Hospital and Guy’s and St Thomas’. Within days the hospitals could not match blood at their normal rate. On 10 June, NHS Blood and Transplant asked O-positive and O-negative donors to book urgently at its 25 donor centres in England, because O-type blood is safe for any patient [ Silicon UK 2024 ] .

Thousands of appointments and operations were cancelled. Qilin published stolen data on its leak site later in June. South East London Integrated Care Board found that 170 patients were harmed, most of them classed as low harm [ The Register 2025 ] .

Synnovis did not pay. It says the decision was made jointly with the NHS trusts it serves, and it has never disclosed what was demanded. Its accounts estimated direct losses for 2024 at £32.7 million, including £6.3 million in IT rebuild costs [ Digital Health 2025 ] . That is one supplier’s bill. The hospitals’ costs, and the patients’, sit on top.

04 How the attackers got in: nobody knows

Synnovis closed its forensic investigation in November 2025, about 18 months after the attack. It said the investigation could not determine how the attackers first got in. All affected infrastructure was replaced. The stolen files came from a working drive, not the main laboratory database. Some held NHS numbers, names and dates of birth [ The Register 2025 ] .

You will read confident accounts of the Synnovis entry point online. None of them is backed by a published finding. What is public is how Qilin affiliates have broken in elsewhere.

In July 2024, a month after Synnovis, Sophos responded to a Qilin attack on a different victim. The attackers logged into a VPN portal with stolen credentials. The portal had no multi-factor authentication. They then waited 18 days before moving. When they reached a domain controller, they edited Group Policy so that every machine ran a script at logon that collected the passwords saved in Google Chrome [ Sophos 2024 ] .

None of those steps needs a zero-day. One login with a single factor. Eighteen days without an alert. One Group Policy change nobody reviewed. You can test for every one of them.

05 Six things a UK healthcare supplier should test

If you supply an NHS trust, a GP federation or a care provider, your outage becomes their clinical incident. You probably already complete the NHS Data Security and Protection Toolkit. That is a self-assessment. The six checks below need someone to try them, and each one maps to a step Qilin affiliates have used.

• Every remote route asks for a second factor. VPN, remote desktop gateways, Citrix, vendor support tools and the old VPN profile from the last migration. One exception is enough.
• Leaked passwords do not work. Check staff and supplier accounts against known breach data, then try them on your login pages before someone else does.
• A quiet, valid login gets noticed. Have a tester log in with a real account and do nothing for a week. Find out whether anyone raised it.
• A Group Policy change raises an alert. Changes to the Default Domain Policy and new logon scripts should reach a person the same day.
• Browsers are not your password manager. Find out how many machines store work passwords in Chrome or Edge, and stop it by policy.
• Patient data is where you think it is. Synnovis lost files from a working drive. Search your shared drives for exports, spreadsheets and test results that outlived their purpose.

Then run the other half of the exercise with your NHS customer. When your system goes dark, what do they do by hand, and how long does it take? At Synnovis, the answer turned into a national blood appeal within a week. Write the fallback down, rehearse it, and time it.

Give us your external address ranges and a list of your remote-access services. Within 14 days you will know which routes work with a stolen password alone, how long an attacker could sit inside before anyone noticed, and which three fixes to make first. Start with a free audit, or read how our external penetration testing works.