German police have detained a 28-year-old Russian man accused of being a core member of the Qilin cybercrime gang, as investigators examine his alleged role in the 2024 ransomware attack on blood-testing provider Synnovis that paralysed hospitals across London and was linked to a patient’s death.
The suspect, identified in German press reports as Vladimir K., was arrested in Japan in May after travelling there on holiday. Japanese officers detained him on arrival after German authorities learned of his travel plans in advance, and he has since been extradited and detained again on landing in Frankfurt.
Detectives in Germany are now formally including the Synnovis incident in their investigation into the suspect and his alleged associates.
Key facts: the 2024 Synnovis attack and recovery
- 3 June 2024: Qilin struck Synnovis, a pathology partnership between NHS hospital trusts and German firm Synlab serving hospitals in south-east London.
- A critical incident was declared. Blood transfusion services were severely disrupted, operations were cancelled, emergency patients were diverted elsewhere, and more than 10,000 appointments were disrupted over the following weeks.
- No ransom was paid. The gang later published highly sensitive patient data on its darknet site.
- A year after the attack, King’s College Hospital NHS Foundation Trust confirmed a patient had “died unexpectedly”, with its safety investigation identifying “a long wait for a blood test result” among the contributing factors – described as the first time a cyber attack was directly connected to a death.
- Recovery took weeks, as trusts rebuilt systems and restored pathology services step by step.
Who are Qilin and how do they operate?
Qilin is a ransomware operation tracked since 2022. Like many modern extortion gangs, it runs a double-extortion model: breaking into victims’ networks, encrypting their data so it cannot be used, and then threatening to publish stolen files on a darknet “leak site” unless a cryptocurrency ransom is paid.
Officials say the group has targeted more than 4,000 organisations since 2024 and extracted more than $140 million from victims, hitting schools, hospitals, councils, companies and health organisations. It was also linked to the disruptive attack on Japanese drinks maker Asahi in October 2025.
At the time of the Synnovis attack, the gang told the BBC the intrusion was a protest connected to the war in Ukraine. That claim was widely dismissed as an attempt to distance the group from its record of criminal extortion.
The arrest comes amid a wider wave of cyber attacks against UK organisations. High-street giants including Harrods and Marks & Spencer were caught up in a UK-wide wave of attacks, while IT systems at fashion retailers Hobbs, Whistles and Phase Eight were knocked out by a separate cyber attack.
What the attack meant for London
For weeks in the summer of 2024, hospitals in south-east London – including Guy’s and St Thomas’ and King’s College Hospital NHS Foundation Trust – were forced to fall back on emergency measures. Blood transfusions, which rely on rapid test results to match donors to patients, were badly affected; operations were postponed, appointments cancelled, and some emergency patients were sent to other hospitals.
The disruption struck at the heart of acute care in the capital. With more than 10,000 appointments affected, patients across south London faced long delays for routine blood tests, while clinicians worked with reduced pathology capacity.
Patient safety remains under the spotlight across the capital’s NHS, with measures such as Martha’s Rule set to be expanded to every A&E in England after a south London teenager’s death.
What happens next
British police are separately examining whether their own inquiry into the Synnovis attack could lead to an unlawful killing case – a move that would be a world first in cybercrime. A similar investigation in Germany, opened after a 2020 attack on a hospital in Düsseldorf, was later dropped when medical experts concluded the patient would have died regardless.
The detained suspect was originally wanted in Germany over a September 2024 attack on a logistics company, in which data was encrypted and a ransom of about $160,000 in cryptocurrency was demanded. His extradition from Japan was first reported in early October, and German prosecutors are continuing to build their case.
