German police have detained a Russian man accused of being part of a cyber-crime gang which caused chaos at London hospitals and contributed to a patient's death.
The hack of blood testing company Synnovis in 2024 led to disrupted pathology services across several London hospitals and was the first cyber attack in history to be directly linked to a death.
The BBC can confirm German detectives are now including the incident in their investigation into the detained Russian and his associates.
Separately, the BBC has learned that British police are examining whether its own inquiry may lead to an unlawful killing case - potentially a world first in cyber-crime.
The detained suspect is a 28-year-old Russian man named by German press as Vladimir K.
He was arrested in Japan in May when he travelled to the country for a holiday.
According to German officials, the suspect's holiday plans were intercepted and he was arrested by Japanese police when he entered the country.
He is accused of being one of the core members of the Qilin cyber-crime gang - which has allegedly hacked more than 4,000 organisations since 2024 and extorted more than $140m (£105m) from victims.
Vladimir K was wanted in Germany for hacking into a logistics company in September 2024, encrypting data on its systems and extorting it for around $160,000 in cryptocurrency.
While his extradition was first reported in early October , the BBC can now confirm German police are including the Synnovis hack in their investigations.
Synnovis is diagnostics and pathology service which operates as a partnership between the hospitals and German company Synlab.
A critical incident was declared at some London hospitals after the provider was targeted by Qilin on 3 June 2024, with blood transfusion services severely disrupted, operations cancelled and emergency patients diverted elsewhere.
King's College Hospital NHS Foundation Trust, one of two trusts heavily impacted, confirmed a year after the hack that one patient had also "died unexpectedly" .
A spokesperson for the trust said a number of contributing factors led to the patient's death including "a long wait for a blood test result".
"The patient safety incident investigation identified a number of contributing factors that led to the patient's death," they said at the time.
A similar attack in 2020 by a different hacker group on a hospital in Düsseldorf in Germany led to a negligent homicide investigation being opened after an elderly patient died.
It was later dropped after medical experts concluded the patient's condition was so severe that they would have died regardless of the issues caused by the cyber-attack.
Prosecutors could also not definitively prove that it was the direct cause of death.
In total, the Synnovis hack in 2024 disrupted more than 10,000 appointments and caused weeks of disruption.
The hackers also threatened to publish the data on their dark net website unless Synnovis paid a ransom.
The criminals eventually published the highly private data online after no ransom was paid.
At the time, they told the BBC the hack was not just for the money but to protest the UK's lack of help in the Russian war on Ukraine .
But the hackers did not say if they were from Russia or Ukraine, and their claims were dismissed as an attempt to distance themselves from the cyber-crime extortion tactics Qilin were known for.
The group, which has been tracked since 2022, is behind a string of criminal hacks targeting schools, hospitals, companies, councils and health organisations.
It was also behind the high profile and disruptive hack on Japanese beer maker Asahi in October 2025.
It is very rare for hackers to be arrested in Russia as its government refuses to co-operate with Western law enforcement requests.
