HCRG Announces Ransomware Attack After One Year
UK-based healthcare firm HCRG has begun notifying patients in June 2026 of a ransomware attack and data breach it discovered more than a year ago, in May 2025. The leaked data includes extremely sensitive medical information.
What Happened
After a full year of silence, Healthcare Resourcing Group (HCRG), one of the UK's leading healthcare staffing companies, has announced that it suffered a ransomware attack and that patient data was compromised. Although the company detected the attack in May 2025, it only began sending notification letters to affected individuals in June 2026. This has reignited debates in the cybersecurity world about "delayed notifications." More than a year is an eternity for stolen data to be misused.
The entity directly affected by the attack is CRG Medical Services, a subsidiary of HCRG that provides forensic medical services to police forces. This detail increases the severity of the incident. The victims are not ordinary patients from a regular hospital; they are individuals who received medical attention while in police custody, meaning they were already going through a highly sensitive and difficult process. The company's justification for such a long delay—a "complex and time-consuming investigation process"—is a reason likely to be questioned by data protection authorities and the victims themselves.
This incident highlights data security vulnerabilities, particularly in the healthcare sector, and deficiencies in post-attack crisis management. While a ransomware attack is bad enough, leaving victims in the dark for over a year about who has their data and how it's being used erodes trust and increases the potential for harm. Such delays often stem from companies' fears of legal repercussions or reputational damage, but the consequences for victims can be far more severe. In this case, the nature of the leaked data dramatically magnifies the risk created by the delay.
Has your email been leaked? Check for free — results in seconds.
Check Now →What Data Was Leaked
A look at what the attackers stole from HCRG's systems reveals just how grim the situation is. According to the notification letter sent by the company, the compromised data is extensive and strikes at the very heart of personal privacy. The list includes:
- Identifying Information: Basic personal data such as full name, address, and date of birth.
- National Identifiers: National Insurance numbers and National Health Service (NHS) numbers used in the UK. These numbers are key to a person's entire relationship with the state and are golden tickets for identity theft.
- Sensitive Medical Information: Perhaps most alarming is the data collected under the heading "information relating to the care and treatment they received." Considering that CRG Medical Services serves individuals in police custody, the content of this information could be extremely sensitive. This data might include examination reports of an assault victim, blood alcohol or drug test results of a suspect, mental health assessments, or details of injuries sustained while in custody.
The combination of this data creates a perfect arsenal for cybercriminals. It can be used not only for financial fraud or identity theft but also for blackmail. The threat of having one's medical records, linked to a judicial process, sold on the dark web or publicly disclosed can have a devastating psychological impact on victims. Criminals can use this information to craft highly convincing phishing attacks targeting the victims, persuading them to give up more information or pay money. Therefore, it's crucial to remember that the stolen data is not just a list but a potential weapon that can turn people's lives upside down.
How Did the Attack Happen
HCRG has been very tight-lipped about the technical details of the attack. Public statements and letters to patients state that the incident was a "ransomware incident" and that there was "unauthorized access" to their systems. However, no information has been shared about how or where this access occurred.
Did the attackers infiltrate the network through a phishing email? Did they exploit a vulnerable server? Or did the attack originate from a third-party IT provider that HCRG works with? The answers to these questions remain unclear for now. Companies often prefer to keep such technical details confidential to avoid affecting ongoing investigations or potential legal proceedings and to not give attackers new clues. However, this means a missed learning opportunity for other organizations wanting to protect themselves from similar attacks. The lack of knowledge about the root cause of the attack also makes it difficult to effectively plan future security strategies. The technical specifics of the attack have not yet been shared with the public.
Who Is Affected
The victims of this data breach include some of the most vulnerable members of society. Those affected are individuals who were served by CRG Medical Services on behalf of various police forces in the UK. This means a very broad and diverse group:
- Detainees: Individuals who were detained on suspicion of any crime and required medical assistance during that time.
- Victims of Crime: Individuals who have been victims of crimes like physical or sexual assault and underwent a forensic medical examination.
- Individuals Needing Mental Health Assessment: People who were assessed for their mental health status during their time in custody.
The common thread among these people is that they received medical services while under the state's protection and in an already stressful situation. The leak of their personal and medical data can deepen their existing trauma. For a victim of a crime, the very idea that their medical details or examination reports could be in the hands of unknown individuals is extremely distressing. This is not just a data security breach but a human crisis. Such a serious violation of the victims' privacy and security can also shake their trust in the justice system and healthcare services.
What You Can Do
If you have received a notification letter from HCRG or CRG Medical Services, or if you believe you may have been affected by this situation, there are some steps you can take without panicking:
- Activate the Free Credit Monitoring Service: The company is offering victims 12 months of free credit monitoring. You should definitely accept this offer. It helps you detect fraudulent financial activities in your name, such as applications for a new credit card or loan, at an early stage.
- Be Vigilant Against Phishing Attacks: Cybercriminals can use this leaked sensitive information to create highly customized emails, text messages, or phone calls. For example, you might receive a very convincing message like, "There is an important health update regarding your police investigation, click here to verify." Remember, no official institution will ask for your password or sensitive information via email. Do not click on suspicious links or open unknown attachments.
- Review Your Account Security: Change the passwords for your important online accounts, such as banking, email, and social media. Enable two-factor authentication (2FA) wherever possible. This is an additional layer of security that prevents unauthorized access to your account even if your password is stolen.
- Check Your Data Breach History: This incident shows how widespread our personal data is and how vulnerable it can be. Using a Data Breach Search platform to see what information of yours might have been compromised in different breaches helps you understand your overall digital risk. It's also beneficial to follow reliable Data Breach News sources to stay updated on such incidents.
What the Company Says
HCRG is presenting a standard corporate defense line in response to the incident. According to the company's statements, they took "immediate action" upon discovering the attack in May 2025. They claim to have engaged third-party cybersecurity experts to secure their systems and investigate the event. Additionally, as required by law, they notified the UK's data protection authority, the Information Commissioner's Office (ICO), and the National Cyber Security Centre (NCSC).
So, if everything was done so promptly, why did it take over a year to inform the patients? The company's answer to this critical question is that the investigation was "complex and time-consuming." HCRG claims it was a long process to determine exactly what data was accessed and to whom that data belonged. It is true that such an analysis can be time-consuming in large, complex systems. However, data protection laws like GDPR require that individuals be informed "without undue delay" in situations involving a "high risk" to their rights and freedoms. Whether a year constitutes an "undue delay" will likely be decided by the ICO. Such a long waiting period could result in significant fines from the ICO. Although the company is offering a 12-month credit monitoring service as a gesture of goodwill, it remains to be seen whether this will be enough to repair the erosion of trust and compensate for the potential harm caused.