HCRG Care Group Data Breach Exposes Patient Information After 15-Month Delay
HCRG Care Group, a healthcare provider serving Bath and North East Somerset, Swindon, and Wiltshire, confirmed a data breach after unauthorized third-party access to its network. The incident, discovered during an investigation with cybersecurity experts, may have resulted in the copying of sensitive patient data, including names, dates of birth, addresses, National Insurance numbers, phone numbers, and hospital records.
John Adams, a 69-year-old patient from Bath who receives daily care from HCRG, was among those affected. He expressed frustration over the 15-month delay in notification, stating he was "fuming" at the lack of communication. While HCRG maintains there is no evidence the data has been misused, Adams raised concerns about potential financial fraud.
The provider, commissioned by the NHS and local authorities to run services such as GP practices and urgent care centers, attributed the delay to the complexity of the investigation and the need to accurately identify impacted individuals. Authorities, including law enforcement and the Information Commissioner’s Office (ICO), were notified, though the breach’s full scope remains under review.
HCRG has since pledged to support affected patients, though the incident has drawn criticism from politicians and patients over response timelines and transparency. The breach highlights ongoing vulnerabilities in healthcare data security.
Source: https://www.bbc.com/news/articles/cpv34kmvp27o
HCRG Care Group cybersecurity rating report: https://www.rankiteo.com/company/hcrgcaregroup
"id": "HCR1781785779",
"linkid": "hcrgcaregroup",
"type": "Breach",
"date": "3/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Patients receiving care from '
'HCRG',
'industry': 'Healthcare',
'location': 'Bath and North East Somerset, Swindon, '
'and Wiltshire, UK',
'name': 'HCRG Care Group',
'type': 'Healthcare Provider'}],
'attack_vector': 'Unauthorized third-party access',
'customer_advisories': 'Support pledged to affected patients',
'data_breach': {'data_exfiltration': 'Possible copying of data',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Names',
'Dates of birth',
'Addresses',
'National Insurance numbers',
'Phone numbers',
'Hospital records']},
'description': 'HCRG Care Group, a healthcare provider serving Bath and North '
'East Somerset, Swindon, and Wiltshire, confirmed a data '
'breach after unauthorized third-party access to its network. '
'The incident may have resulted in the copying of sensitive '
'patient data, including names, dates of birth, addresses, '
'National Insurance numbers, phone numbers, and hospital '
'records.',
'impact': {'brand_reputation_impact': 'Yes',
'customer_complaints': 'Yes',
'data_compromised': 'Sensitive patient data, including names, '
'dates of birth, addresses, National Insurance '
'numbers, phone numbers, and hospital records',
'identity_theft_risk': 'Yes'},
'investigation_status': 'Under review',
'lessons_learned': 'The incident highlights ongoing vulnerabilities in '
'healthcare data security and the importance of timely '
'communication with affected individuals.',
'post_incident_analysis': {'root_causes': 'Unauthorized third-party access to '
'network'},
'references': [{'source': 'Cyber incident description'}],
'regulatory_compliance': {'regulatory_notifications': ['Information '
'Commissioner’s Office '
'(ICO)']},
'response': {'communication_strategy': 'Delayed notification to affected '
'patients',
'law_enforcement_notified': 'Yes',
'third_party_assistance': 'Cybersecurity experts'},
'title': 'HCRG Care Group Data Breach Exposes Patient Information After '
'15-Month Delay',
'type': 'Data Breach'}