Cyberattacks | Data breaches

Vulnerable Children's Health Data Exposed in Cyber Attack — Families Told 18 Months Later

Families outraged as personal health data of vulnerable children accessed in cyber attack on HCRG, notified 18 months later.

By Content Team

Sep 23, 2026

ON THIS PAGE

Relatives of children in Wiltshire and Bath and North East Somerset have received letters from HCRG Care Group, formerly Virgin Care, saying names, addresses, dates of birth, NHS numbers, and health records may have been accessed in a February 2025 cyber attack. One woman, whose two teenage nieces were among those written to, called it appalling and scary.

The attack was ransomware, claimed by the Medusa group, which said it took 50TB of data. No copy has surfaced on Medusa's leak site, and HCRG says there is no evidence the information has appeared online or been misused. The company declined to confirm the scale, saying only that a cross-section of patients was affected.

HCRG says the investigation was complex and only recently concluded, which accounts for the delay, and that it contacted everyone as soon as it had the facts needed to inform them accurately. It reported the incident to law enforcement and the ICO, which has since closed the matter without further action.

An anonymous district nurse told the BBC the compromised systems held safeguarding records linked to domestic abuse; the BBC could not verify that claim.

Source: BBC News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?