German police have detained a 28-year-old Russian man accused of being a core member of the Qilin cyber-crime gang, and German detectives are now including in their investigation the 2024 hack of the London blood-testing company Synnovis — the first cyber attack in history directly linked to a death.
The arrest
The suspect, named by German press as Vladimir K., was arrested in Japan in May, after officials intercepted his holiday plans and Japanese police detained him on arrival. He was wanted in Germany over a September 2024 attack on a logistics company, whose systems were encrypted and which was extorted for around $160,000 in cryptocurrency. His extradition was first reported in early October; what is new is that German investigators are now folding the Synnovis case into the inquiry.
Qilin is accused of hacking more than 4,000 organisations since 2024 and extorting over $140m from victims — schools, hospitals, companies, councils and health organisations among them.
What the Synnovis hack did
Synnovis is a diagnostics and pathology service run as a partnership between London hospitals and the German company Synlab. Qilin hit it on 3 June 2024. A critical incident was declared: blood transfusion services were severely disrupted, operations were cancelled, and emergency patients were diverted elsewhere. In total the attack disrupted more than 10,000 appointments and caused weeks of difficulty.
A year later, King’s College Hospital NHS Foundation Trust confirmed that one patient had “died unexpectedly”. A spokesperson said the patient safety investigation identified a number of contributing factors, including “a long wait for a blood test result”.
No ransom was paid. The attackers published the private data online, and told the BBC the hack was not only about money but a protest over Britain’s support for Ukraine — a claim dismissed at the time as an attempt to dress up ordinary extortion.
Why a legal first may be coming
The BBC has learned British police are examining whether their own inquiry may lead to an unlawful killing case. That would be a world first in cyber-crime, and the precedent cuts both ways. In 2020 a hospital in Düsseldorf was hit by a different group and an elderly patient died; a negligent homicide investigation was opened and later dropped, because medical experts concluded the patient would have died regardless and prosecutors could not prove the attack was the direct cause.
That is the whole difficulty. Proving a chain from an encrypted server to a specific death requires showing what would have happened otherwise — and hospitals are places where people die of the thing they came in with. The charge is easy to understand and extremely hard to establish.
The question this raises here
Bangladesh has no equivalent of Synnovis, and that is not reassuring. Pathology here is fragmented across private diagnostic chains and hospital labs, which limits the blast radius of any single attack but also means there is no single body whose failure would trigger a national incident response. Most labs run commercial lab-information systems with support contracts, backups of uncertain age, and no obligation to tell anyone when something goes wrong.
The useful question for any hospital administrator reading this is not whether a ransomware gang will come. It is narrower: how long can this hospital run its blood work on paper, who decides to switch, and has anyone ever tried it? The London hospitals that coped best in June 2024 were the ones that could answer that before they needed to.
Related: Japan’s cyberspace state of emergency.
