HCRG Care Group Cyber Attack Claims
If you’ve been affected by the HCRG Care Group cyber attack, you could be entitled to claim compensation for the impact it’s had on you.
The incident is reported to have exposed sensitive personal, medical and employment information, leaving many patients, service users and employees concerned about their privacy and the possibility of fraud or identity theft.
At HNK Solicitors, our specialist data breach team can assess your circumstances free of charge and explain whether you may have grounds to bring a claim on a no win, no fee basis. Simply get in touch with our experts to begin.
What happened in the HCRG Care Group cyber attack?
In February 2025, HCRG Care Group announced it was investigating a cyber incident after the Medusa ransomware group claimed responsibility for accessing the organisation’s systems.
According to reports, the group alleged it had obtained approximately 2.3 terabytes of information and demanded a ransom of $2 million (around £1.6 million). It was also reported that the compromised data included around 500,000 patient records and 5,000 employee records containing highly sensitive information.
Many people affected by the incident were reportedly not informed until June 2026, around 15 months after the attack is believed to have taken place. For those individuals, this meant they may have spent more than a year unaware that their personal information had potentially been compromised.
How do I claim?
Step 1
Get in contact by using one of our contact forms throughout the site.
Step 2
We will assess your case based on the information you provide.
Step 3
If you have a valid claim, we will accept your case on a No Win No Fee basis.
Step 4
Claim nowWhy the 15-month notification delay could be relevant to your claim
Learning that your personal or medical information may have been exposed can be deeply unsettling. Discovering this long after the incident may increase the emotional impact.
Under UK data protection law, compensation isn’t limited to financial losses. If a data breach has caused distress, anxiety or other psychological harm, you may still have the right to pursue a claim.
The reported delay in notifying affected individuals may be significant because:
- You may have missed the opportunity to take preventative action, like monitoring your credit file, changing passwords or increasing account security.
- A delayed notification may have prolonged uncertainty and heightened the emotional impact once you eventually became aware of the breach.
- It may raise questions about how the incident was managed and whether affected individuals were informed within an appropriate timeframe.
If you’ve received a notification letter or email from HCRG Care Group, keep it somewhere safe, as it could form part of the evidence supporting your claim.
What personal and medical information may have been affected?
The information that was compromised may differ depending on whether you were receiving care from HCRG Care Group or were employed by the organisation.
Your notification from HCRG Care Group should outline the categories of information believed to have been affected in your individual case.
NHS numbers and home addresses
Medical records and treatment history
Prescription information
Dates of birth and identity documents
Other personal identifying information
National Insurance numbers
Salary and payroll information
Employment records and background checks
Bank account details
Staff rotas and personnel records
Your notification from HCRG Care Group should outline the categories of information believed to have been affected in your individual case.
Medical information is classed as special category data under GDPR. This type of information receives enhanced legal protection because of its sensitive nature.
Where confidential medical records, financial details or identity information are exposed, the consequences can extend beyond financial concerns. You might experience a loss of privacy, anxiety about future misuse of information and reduced confidence in how data is protected.
If you’ve been notified that your information was involved, we can explain whether you may have grounds to seek compensation.
Understanding the High Court injunction against “Persons Unknown”
Following the cyber attack, the High Court granted an injunction against the unidentified individuals alleged to have accessed HCRG Care Group’s systems between approximately 26 January 2025 and 12 February 2025.
The purpose of the injunction was to prevent the stolen confidential information from being disclosed, shared or used further.
The injunction reflects the confidential nature of the material involved. However, it can’t undo unauthorised access that has already happened or guarantee that every copy of the information can be recovered.
As a result, you may still be concerned about:
- Identity theft
- Fraud or attempted fraud
- Targeted phishing emails and scam messages
- Ongoing misuse of personal information
- The stress of knowing confidential data may have been exposed
How to record the impact of the breach
If you’re considering making a data breach claim, keeping evidence of how the incident has affected you can help support your case. You should:
- Keep your HCRG Care Group notification letter or email.
- Save copies of suspicious emails, text messages or telephone calls received after the breach.
- Record any financial losses or fraudulent activity linked to your personal information.
- Keep a diary of any emotional impact, including anxiety, stress, disrupted sleep or concerns about your privacy.
- Retain medical records if you’ve sought treatment or support for distress resulting from the breach.
- Speak to HNK Solicitors to find out what evidence could be helpful for your individual circumstances.
You don’t need to have every document before contacting us. We can advise you on the evidence that may strengthen your claim.
Start your HCRG Care Group data breach claim on a no win, no fee basis
HNK Solicitors offers eligible clients the opportunity to pursue data breach claims under a no win, no fee agreement.
This means you won’t pay our legal fees if your claim is unsuccessful, provided the terms of the agreement are met.
If your claim succeeds, an agreed success fee will be deducted from your compensation. We’ll explain exactly how this works before you decide whether to proceed.
A claim can involve:
Confirming that your information was affected
Reviewing the type of data involved
Assessing the impact the breach has had on you
Identifying any financial losses or psychological harm
Gathering supporting evidence
Considering whether data protection law may have been breached
Corresponding with HCRG Care Group or its representatives
Negotiating compensation where appropriate
Our team will guide you through every stage of the process and keep you informed throughout your claim.
HCRG Care Group cyber attack FAQs
HCRG Care Group has reportedly been issuing notification letters to affected patients and employees, with some individuals receiving them during June 2026. If you’ve received an official notification confirming your information was involved, it’s likely your data was affected. People who received services in areas including Bath and North East Somerset, Swindon, Wiltshire, Kent and Surrey may also wish to check whether they’ve been impacted.
You may be able to bring a claim if your personal information was compromised and you’ve suffered financial loss or psychological harm as a result. Eligibility will depend on the facts of your individual case, and a solicitor can advise whether you have grounds to proceed.
The amount of compensation awarded varies from case to case. It will depend on factors including the nature of the information involved, the severity of any distress you’ve experienced and whether you’ve suffered financial losses linked to the breach. HNK Solicitors can assess your circumstances and provide tailored advice on the potential value of your claim.
No. Bringing a legal claim following a data breach should not affect the healthcare or support you receive from HCRG Care Group, the NHS or your local authority. Pursuing compensation is a separate legal matter and exercising your legal rights shouldn’t impact your ongoing care.
Get in touch with our data breach specialists
The HCRG Care Group cyber attack has understandably left many patients, service users and employees concerned about the security of their personal information.
If your data has been compromised and you’ve been affected as a result, you may be entitled to seek compensation.
HNK Solicitors can assess your circumstances, explain your legal options and advise whether you have a valid claim.
Contact our specialist team today to discuss your potential no win, no fee data breach claim.
Free Consultation
Contact HNK to arrange a free no-obligation consultation where we can offer free advice on whether you can pursue a claim against HCRG Care Group.
No-Win-No-Fee
If we believe you have a case, we can pursue your claim for you on a no-win, no-fee agreement. This means it will not cost you a penny to start your claim, and you won’t have to pay if it is not successful.
Client Communication
If we accept your case against HCRG Care Group, our dedicated team of Data Protection Solicitors will handle everything for you and keep you up to date throughout the whole process.
