Seven NHS trusts across England have suffered ransomware incidents in the nine months to September 2026, according to mandatory incident reports submitted to the National Cyber Security Centre and obtained by Exposed News under the Freedom of Information Act. The combined operational disruption — measured in cancelled appointments, diverted emergency admissions, and emergency IT recovery expenditure — is estimated by NHS England’s own incident review team at £43 million.
The attacks follow the catastrophic Synnovis ransomware incident of June 2024, in which a Russian-linked cybercriminal group breached the pathology services provider, forcing King’s College Hospital and Guy’s and St Thomas’ NHS Foundation Trust to cancel more than 10,000 outpatient appointments and 1,700 operations. The NCSC described the 2024 attack as the most significant cyberattack ever to affect the UK health sector.
Budget Frozen Despite Warnings
NHS England’s central cybersecurity improvement budget — distinct from individual trust IT budgets — stood at £338 million in 2023/24. FOI responses show it was held at the same nominal level in 2024/25 and 2025/26, representing a real-terms cut of approximately 14% after inflation. A further freeze is projected for 2026/27 under current spending review plans.
The NCSC’s 2025 annual review warned that the NHS remained “a priority target for state-affiliated and criminal ransomware actors” and that the pace of cyber investment across health trusts was “insufficient to match the evolving threat.” The review recommended a minimum annual increase of 8% in NHS cybersecurity spending in real terms for five consecutive years.
Legacy Systems the Weak Point
Of the seven 2026 incidents, five involved initial access gained through legacy systems running software no longer supported by its vendor. NHS England’s own IT estate assessment, published in February 2026, found that 22% of clinical systems across acute trusts were running software that had reached end-of-life. The replacement programme for the most critical of these systems is not funded to completion until 2031.
A Department of Health and Social Care spokesperson said the government had “made cyber resilience a priority” and pointed to £100 million in one-off funding announced in the 2025 Autumn Budget. Cybersecurity researchers contacted by Exposed News described the sum as “inadequate relative to the scale of legacy exposure.”