Russian suspect held in Germany as police look at the hack that crippled London hospitals

The story

German police are holding a 28 year old Russian man they say was one of the main members of Qilin, a ransomware gang blamed for attacks on thousands of organisations around the world. Investigators are now including the 2024 attack on Synnovis, a company that ran blood tests for several London hospitals, in their case against him and his associates.

The man has been named in the German press as Vladimir K. He was arrested in Japan in May while on holiday, after German officials learned of his travel plans and alerted Japanese police. He was then sent to Germany, where he landed at Frankfurt airport earlier this month and was taken into custody.

He was already wanted in Germany over a September 2024 attack on a logistics company. In that case, the firm's data was locked up and it was pushed to pay about $160,000 in cryptocurrency. Qilin as a whole is accused of breaking into more than 4,000 organisations since 2024 and taking more than $140 million from victims.

The Synnovis attack in June 2024 caused serious disruption in London. Hospitals declared a critical incident, blood transfusion services were badly affected, operations were cancelled and some emergency patients were sent elsewhere. It later became the first cyberattack directly linked to a patient's death.

Arrests like this are rare. Russia does not usually cooperate with Western police, so suspects tend to be caught only when they travel abroad. Even so, the gang has kept working, listing more than 450 new victims on its leak site since June.