Wirral cyber attack set back cancer waiting times by months
- 3 February 2025

- Waiting times for cancer, elective and diagnostic pathways at Wirral University Teaching Hospital NHS Foundation Trust have been “significantly impacted” by a cyber incident in November 2024
- The incident led to the cancellation of all outpatient appointments at Arrowe Park Hospital for several days
- Hayley Kendall, chief operating officer and deputy chief executive at the trust, said that it will take "a number of months" for cancer performance to recover from the incident
Waiting times for cancer, elective and diagnostic pathways at Wirral University Teaching Hospital NHS Foundation Trust have been “significantly impacted” by last year’s cyber incident and will take “a number of months to recover”, according to board papers.
A report by Hayley Kendall, chief operating officer and deputy chief executive at the trust, published on 29 January 2025, said: “The trust has been in a strong position with improving waiting times for elective, diagnostic and cancer pathways but this performance has been significantly impacted by the cyber attack that was experienced late November and into early December.”
A major incident was declared at Wirral University Teaching Hospital NHS Foundation Trust on 25 November 2024, which led to the cancellation of all outpatient appointments at Arrowe Park Hospital until services were reinstated on 4 December 2024.
The trust attained an overall performance of 73.98% against plan for outpatients (81.81% for new outpatients) and an overall performance of 81.93% against the plan for elective admissions in December 2024.
Kendall said: “The trust underachieved plan for both outpatient new appointments and elective inpatients/day case, with the delivery and capture of activity impacted by the cyber
incident, which saw the cancellation of clinic appointments, elective activity and interruption of recording of activity onto Cerner.
“Under delivery of outpatients and elective admitted care was seen across all clinical divisions.
“Divisional teams are currently working on ensuring all activity that took place is captured as part of the focus of restoration following the cyber incident.”
In relation to cancer performance, Kendall said: “Whilst performance for October and November was positive for both the 28-day and 62-day treatment standards, the forecasts for December and January predict a deterioration in performance.
“Performance over December is seen to dip seasonally with reduced capacity, but the cyber incident has impacted cancer performance and will take a number of months to recover from.”
She added: “The cyber incident was seen to impact elective performance both in terms of the loss of activity that would have provided treatment / diagnostic and stopped waiting times for patients, and on the ability to validate the waiting times position.
“Performance across RTT [referral to treatment], cancer and diagnostics was affected. Operational teams are working through plans to recover lost activity.”
A spokesperson for Wirral University Teaching Hospital told Digital Health News that the trust had responded “swiftly” to the cyber incident, prioritising patient safety and maintaining services despite the challenges.
“Thanks to the dedication and professionalism of our staff, we continued to provide care while implementing our business continuity plans.
“Recovery plans were implemented immediately to proactively recover any lost activity, ensuring patients affected by the disruption are prioritised.
“Our teams are focused on restoring performance across elective, diagnostic, and cancer pathways as quickly as possible, and we have already made significant progress,” they said.
Meanwhile, patient harm figures revealed in January 2025, show that the ransomware attack on NHS pathology provider Synnovis in June 2024 led to at least two cases of severe patient harm, 11 cases of moderate harm, and more than 120 cases of low harm.