Vulnerable kids' records caught up in cyber attack

The family of vulnerable children whose personal health information was accessed during a cyber attack on a healthcare provider say they are angry and worried after being informed 18 months after the incident.

Relatives of some children in Wiltshire and Bath and North East Somerset (BANES) received letters warning medical information may have been compromised at HCRG Care Group in February 2025.

One woman said her two teenage nieces' received the letter and added: "This is appalling and really scary."

HCRG declined to confirm the scale of the incident, but said it included "a cross-section" of patients and the "complex" investigation had "only recently concluded", accounting for any delays.

The woman told BBC Points West the letter states their names, addresses, dates of birth, NHS numbers and health records could have been accessed.

"We are now really worried that their very private information could be held or sold on the dark web," she said.

"I have further concerns over the fact that my nieces are now getting lots of scam calls which may be linked," she added.

"What makes this even worse is that it's taken HCRG Care Group over 18 months to notify them."

The healthcare provider, formerly known as Virgin Care, runs a range of NHS-funded community health and social care services across Wiltshire, Bath and North East Somerset, and Swindon.

The concerns follow a BBC report in June, which revealed patients were only then beginning to receive letters about the February 2025 cyber attack.

At the time, 69-year-old Bath resident John Adams said he was "fuming" after being told his personal information may have been compromised 15 months earlier.

An investigation by HCRG found that affected information could include names, addresses, dates of birth, NHS numbers and health and care information.

An anonymous district nurse who contacted the BBC claimed there was widespread concern among staff about the length of time taken to notify patients.

The nurse also alleged the compromised systems contained highly sensitive safeguarding information relating to both children and adults, including information connected to domestic abuse and other vulnerable circumstances.

The BBC has not been able to independently verify those claims.

In a statement, an HCRG spokesperson said: "We acted immediately to contain and resolve the IT security incident in February last year and reported it to law enforcement and the Information Commissioner's Office.

"The ICO has concluded its consideration of the incident and closed the matter without further action

"There is no evidence that the affected information has appeared online or been misused."

The company said the cyber attack had previously been reported publicly and stressed that it was not a newly discovered breach.

"We contacted everyone identified as affected as soon as we had the facts needed to inform them accurately, and are continuing to provide appropriate support," the spokesperson added.

Follow BBC Wiltshire on Facebook, X and Instagram. Send your story ideas to us on email or via WhatsApp on 0800 313 4630.