A Russian man, a fatal London hack and a possible world-first murder inquiry

Key points

• German authorities detained Vladimir K., 28, a Russian national accused of being a core Qilin member, after Japanese police arrested him in May 2025 when he arrived for a holiday.
• The 2024 Qilin attack on blood-testing firm Synnovis disrupted more than 10,000 NHS appointments across several London hospitals and is the first cyber attack ever directly linked to a patient death.
• British police are examining whether the Synnovis case could become an unlawful killing prosecution, which would be a world first in cyber-crime law.
• Qilin has allegedly extorted more than $140 million from victims since 2024, targeting more than 4,000 organisations.
• No charges have been filed in the unlawful killing inquiry, which remains at an early stage.

Qilin is a ransomware-as-a-service operation, meaning it is a criminal business that rents out file-locking software to affiliated hackers and takes a cut of any ransoms paid. Tracked since 2022, the group has hit schools, hospitals and councils across multiple continents. Its most consequential attack to date struck London.

On 3 June 2024, Qilin broke into Synnovis, a diagnostics and pathology provider that processes blood tests for major London NHS trusts. The attack encrypted Synnovis's systems, scrambling files so staff could not read them, and brought blood transfusion services to a halt. Hospitals declared critical incidents, cancelled operations and diverted emergency patients. King's College Hospital NHS Foundation Trust confirmed, a year after the attack, that one patient had "died unexpectedly" following a prolonged wait for a blood test result.

Synnovis refused to pay the ransom. Qilin published the stolen patient data on its dark-web leak site anyway. The group told the BBC the attack was partly political protest over UK support for Ukraine, a claim investigators largely dismissed as an attempt to deflect from straightforward extortion.

How did the arrest happen?

German police were already hunting a Qilin-linked suspect for a separate job: a September 2024 attack on a German logistics company, where the hackers encrypted the firm's data and demanded roughly $160,000 in cryptocurrency. Investigators intercepted the suspect's holiday travel plans and tipped off Japanese authorities. Vladimir K. Was arrested when he landed in Japan in May 2025.

His extradition to Germany was first reported in early October. The BBC has since confirmed that German detectives are now folding the Synnovis attack into their investigation. We covered the initial extradition on 10 October 2026 in our earlier report on the logistics company charges, before the Synnovis connection was confirmed.

Russian nationals are rarely prosecuted for cyber-crime because Russia refuses to extradite its citizens to Western countries. Arrests happen only when suspects travel abroad.

What does this mean for patients and the public?

British police are separately examining whether the Synnovis investigation could support an unlawful killing charge, a step that has never been taken anywhere in the world over a cyber attack. No charges have been filed.

Patients whose data was published by Qilin after the Synnovis breach should assume their medical records are accessible on criminal forums. If you received care at an affected London trust in or before mid-2024 and have not been contacted about the breach, contact your GP or the trust's data protection officer directly.

This is a group that killed someone and kept advertising on its leak site the next day. That's the detail courts will have to reckon with if the UK unlawful killing case moves forward.