Question to the Department of Health and Social Care:

To ask the Secretary of State for Health and Social Care, what estimate he has made of the cost to the public purse of cyber-attacks against the NHS since 2021.

We do not hold data for the total economic impact of cyber incidents on National Health Service organisations specifically.

Cyber-attacks can have a significant economic impact. The WannaCry cyber-attack in 2017 was estimated by the Department to have cost the NHS £92 million. Public estimates of the impact of the Synnovis cyber-attack stand at £32.7 million, according to accounts filed on Companies House.

NHS trusts are independent organisations with their own set budgets, and a decision will be made on a case-by-case basis as to whether the economic impact of smaller incidents is assessed.

Government is working to fully assess the impact of cyber-attacks on the wider public sector. It is worth noting that the economic impact of cyber incidents affected by a wide variety of complex factors. Further information about the financial cost of breaches or attacks can be found in the Cyber security breaches survey 2025, published by the Department for Science, innovation and Technology (DSIT). This is available at the following link:

https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2025/cyber-security-breaches-survey-2025