REVEALED: How a major Russian cyber attack on the NHS is believed to be much worse than feared - and led to the theft of private medical records of patients treated at hundreds of hospitals and clinics

A major Russian cyber attack on the NHS is believed to be much worse than feared – and led to the theft of private medical records of patients treated at hundreds of hospitals and clinics.

An analysis by The Mail on Sunday of the stolen medical data leaked online discovered information from 600 clinics, including patients' names, addresses and details of clinical tests.

Records of some 300 million appointments were obtained in the devastating hack on an NHS contractor, which has led to thousands of operations being cancelled at seven London hospitals.

But this newspaper has found data that suggests that hundreds of hospitals all over the country are also affected.

Russian hacking group Qilin this month shut down IT systems at private pathology lab Synnovis, which analyses blood, urine and tumour samples for the NHS.

The criminal gang threatened to release the stolen data unless a £40million ransom was paid. 

It started leaking thousands of files of data on the internet on Friday when the demand was not met.

Just one spreadsheet from the hack, seen by The Mail on Sunday, contains blood test data of tens of thousands of patients treated at 138 UK hospitals and clinics, going back more than a decade.

The hack has already caused serious disruption for seven hospitals run by King's College Trust and Guy's and St Thomas' Trust, in London, where 1,134 planned operations, including cancer and transplant surgery, were cancelled and 2,194 outpatient appointments postponed.

Philip Ingram, a former British military intelligence colonel, urged Synnovis to be 'fully transparent' about the extent of the breach.

He said: 'If there is evidence that this hack goes beyond the one hospital trust, then Synnovis needs to say exactly what data it suspects has been accessed.'

The National Crime Agency is weighing up taking retaliatory action and the NHS has set up an emergency helpline to answer patients' queries.

NHS England said: 'We understand that people may be concerned by this and are continuing to work with Synnovis, the National Cyber Security Centre and other partners to determine the content of published files as quickly as possible.'

Synnovis said: 'We know how worrying this development may be for many people. We are taking it very seriously and an analysis of this data is underway.'