--- title: "Vulnerable children's health records caught up… | Firevault" url: https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026 description: "Families of vulnerable children in Wiltshire, Bath and North East Somerset have been told their personal health information may have been accessed in a cyber…" lang: en-GB --- News · Breach Analysis · 20 September 2026 # Vulnerable children's health records caught up in HCRG Care Group cyber attack, families told 18 months later Families of vulnerable children in Wiltshire, Bath and North East Somerset have been told their personal health information may have been accessed in a cyber attack on HCRG Care Group in February 2025, more than 18 months after the incident. Image: Mark Fermor (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) Mark Fermor CTO, CMO & Founder, Firevault 4 min read Share Share on LinkedIn: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fhcrg-care-group-children-records-cyber-attack-2026 Share on X: https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fhcrg-care-group-children-records-cyber-attack-2026&text=Vulnerable%20children%27s%20health%20records%20caught%20up%20in%20HCRG%20Care%20Group%20cyber%20attack%2C%20families%20told%2018%20months%20later%0A%0AFamilies%20of%20vulnerable%20children%20in%20Wiltshire%2C%20Bath%20and%20North%20East%20Somerset%20have%20been%20told%20their%20personal%20health%20information%20may%20have%20been%20accessed%20in%20a%20cyber%20attack%20on%20HCRG%20Care%20Group%20in%20February%202025%2C%20more%20than%2018%20months%20after%20the%20incident. Share on Facebook: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Fhcrg-care-group-children-records-cyber-attack-2026 Image: A glowing cyan folder of children's health records with a stethoscope beside it on a dark navy background, next to a cracked envelope glowing magenta to represent a delayed breach notification letter (https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026.jpg) A glowing cyan folder of children's health records with a stethoscope beside it on a dark navy background, next to a cracked envelope glowing magenta to represent a delayed breach notification letter Why it matters ## What this means for organisations holding critical data Families of vulnerable children whose personal health information was accessed during a cyber attack on a healthcare provider have spoken of their anger after being informed more than 18 months after the incident, the BBC reported on 15 September 2026. Relatives of children in Wiltshire and Bath and North East Somerset received letters warning that medical information may have been compromised at HCRG Care Group, formerly known as Virgin Care, during an attack in February 2025. The company runs NHS-funded community health and social care services across Wiltshire, Bath and North East Somerset, and Swindon. ## What was exposed According to the letters, affected information could include names, addresses, dates of birth, NHS numbers and health and care records. One relative told BBC Points West that her two teenage nieces were now receiving scam calls that she fears may be linked, adding: "We are now really worried that their very private information could be held or sold on the dark web." An anonymous district nurse who contacted the BBC alleged that the compromised systems also contained highly sensitive safeguarding information relating to children and adults, including information connected to domestic abuse and other vulnerable circumstances. The BBC noted it had not been able to independently verify those claims. HCRG declined to confirm the scale of the incident, saying it included "a cross-section" of patients and that the "complex" investigation had "only recently concluded", accounting for the delay. ## The delay is its own harm This is the second wave of distress from the same incident. In June, the BBC revealed that patients were only then beginning to receive letters, including a 69-year-old Bath resident who said he was "fuming" at being told 15 months after the fact. Some families have now waited more than 18 months. Notification delay is not an administrative footnote. Every month of silence is a month in which affected people cannot change routines, watch for misuse or protect their children, while whoever holds the data faces no such constraint. Under the United Kingdom data protection framework, breaches likely to result in a high risk to individuals must be communicated without undue delay; safeguarding data concerning children sits at the sharpest end of that obligation. HCRG said it acted immediately to contain and resolve the incident, reported it to law enforcement and the Information Commissioner's Office, and that the ICO concluded its consideration and closed the matter without further action. The company said there is no evidence the information has appeared online or been misused, and that it contacted everyone identified as affected as soon as it had the facts to inform them accurately. ## The care sector keeps appearing in these stories Health and care providers hold exactly the records criminals value most: identity, medical history, safeguarding context and family detail, much of it about people who cannot protect themselves. The sector also runs on tight margins, legacy systems and shared community infrastructure, which makes it a persistent target. Firevault's own published customer story involves a multi-site care organisation protecting storage and backups for precisely this reason. The controls that matter are not exotic: strict separation between the systems that face the internet and the systems that retain records, and a copy of the most sensitive data that no remote session can reach at all. ## Where Offline Secure Storage fits If an attacker reaches the live network, everything continuously connected to that network is in scope: it can be browsed, copied, encrypted or deleted. Records held on dedicated hardware with no standing network path are not in scope, because there is no route to them. Access opens only through an authorised, out-of-band request for a defined window and then closes again. That does not prevent a breach of live systems, and it does not absolve any provider of the duty to notify quickly. What it changes is the ceiling on the damage: retained records, archives and safeguarding files that were offline at the moment of intrusion remain untouched, recoverable and provably so. For organisations caring for vulnerable people, that ceiling is the difference between a contained incident and a letter to a frightened family 18 months later. About the author ### Mark Fermor Mark Fermor on LinkedIn (https://www.linkedin.com/in/mfermor) CTO, CMO & Founder Founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. How Firevault would handle this ## A recovery copy an attacker cannot reach Offline Secure Storage® keeps a clean copy of your data on hardware that is physically disconnected, so backup and recovery do not depend on systems an intruder can touch. Get started: https://fire-vault.com/get-started Talk to the team: https://fire-vault.com/demo **Hardware**Your copy sits on dedicated encrypted hardware **Disconnect**Offline by default, connected only when you say so **Recovery**A known-clean copy to rebuild from, on your timetable **Location**Held in a secure Firevault Bunker Related Reading ## You may also find these useful Breach Analysis ### ASOS data breach: stolen customer profiles and a hijacked app notification ASOS confirms customer-data exposure after attackers hijacked its app notifications. What happened, what was taken and why a stolen login can put more than contact details at risk. 12 Oct 2026 14 min https://fire-vault.com/news/asos-data-breach-customer-profiles-october-2026 Breach Analysis ### Dyfed-Powys Police confirms cyber attack as staff information may have been compromised Dyfed-Powys Police has confirmed that a cyber attack identified on 14 September disrupted non-emergency systems and may have exposed staff information. The force says it has found no evidence that public data was accessed. 25 Sept 2026 3 min https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026 Breach Analysis ### FBI investigates claims that hackers stole personnel and applicant data The FBI is investigating unauthorised activity affecting its recruitment website after ShinyHunters claimed it stole sensitive records on current and former personnel and job applicants. The claimed scale remains unconfirmed. 22 Sept 2026 4 min https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026 Breach Analysis ### FBI and Coast Guard board oil tankers after suspected foreign cyberattacks on ships entering US waters US authorities boarded two foreign-flagged oil tankers in the Gulf of Mexico after indications their networks were compromised by foreign cyber actors. Mark Fermor on why a ship is a floating lesson in what happens when operational technology is reachable. 17 Sept 2026 4 min https://fire-vault.com/news/fbi-coast-guard-probe-cyberattacks-oil-tankers-us-waters-2026 Breach Analysis ### FBI investigates 153 million drivers licenses put up for sale on a criminal forum A dark web service claimed to be selling scans of more than 153 million drivers licenses, apparently taken from a Louisiana identity verification company used by household names. The FBI has opened an inquiry, and the case shows how long retention turns a routine check into national-scale exposure. 16 Sept 2026 4 min https://fire-vault.com/news/fbi-investigates-153-million-drivers-licenses-dark-web-2026 Breach Analysis ### CenterPoint Energy confirms hackers stole customer data through an exposed API CenterPoint Energy has confirmed that criminals stole customer data through one of its external facing systems, after a threat actor advertised 7.49 million files on a dark web forum. Mark Fermor on what an unsecured API says about the way critical infrastructure treats connected data. 16 Sept 2026 4 min https://fire-vault.com/news/centerpoint-energy-confirms-cyberattack-data-theft-2026 ## Suggested Reading - What is Offline Secure Storage The foundation of physical disconnection: https://fire-vault.com/how-it-works/offline-secure-storage - Why Offline Secure Storage The case for physical control: https://fire-vault.com/why-oss - Ransomware Defence Hold gold copies offline: https://fire-vault.com/oss-for-ransomware-recovery - Control Physical path control for IT and OT: https://fire-vault.com/solutions/control - Knowledge Vault All articles, guides and whitepapers: https://fire-vault.com/learn/knowledge - Book a Demo See Firevault in action: https://fire-vault.com/demo Back to Knowledge Vault: https://fire-vault.com/learn/knowledge ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026#webpage", "url": "https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026", "name": "Vulnerable children's health records caught up…", "description": "Families of vulnerable children in Wiltshire, Bath and North East Somerset have been told their personal health information may have been accessed in a cyber…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Vulnerable children's health records caught up in HCRG Care Group cyber attack, families told 18 months later", "item": "https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "Vulnerable children's health records caught up in HCRG Care Group cyber attack, families told 18 months later", "description": "Families of vulnerable children in Wiltshire, Bath and North East Somerset have been told their personal health information may have been accessed in a cyber attack on HCRG Care Group in February 2025, more than 18 months after the incident.", "url": "https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-09-20T06:50:00+00:00", "dateModified": "2026-09-20T06:44:49.58405+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026" }, "inLanguage": "en-GB", "articleSection": "Breach Analysis", "wordCount": 692, "keywords": "Vulnerable, Breach Analysis, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "Families of vulnerable children whose personal health information was accessed during a cyber attack on a healthcare provider have spoken of their anger after being informed more than 18 months after the incident, the BBC reported on 15 September 2026. Relatives of children in Wiltshire and Bath and North East Somerset received letters warning that medical information may have been compromised at ", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What happened at HCRG Care Group?", "acceptedAnswer": { "@type": "Answer", "text": "A third party temporarily gained unauthorised access to the HCRG Care Group network in February 2025. Information that may have been accessed includes names, addresses, dates of birth, NHS numbers and health and care records. HCRG declined to confirm the scale, saying it included a cross-section of patients." } }, { "@type": "Question", "name": "Why are families only being told now?", "acceptedAnswer": { "@type": "Answer", "text": "HCRG said its complex investigation only recently concluded and that it contacted everyone identified as affected as soon as it had the facts needed to inform them accurately. Some families received letters more than 18 months after the incident." } }, { "@type": "Question", "name": "What did the ICO do?", "acceptedAnswer": { "@type": "Answer", "text": "HCRG reported the incident to law enforcement and the Information Commissioner's Office. The ICO concluded its consideration of the incident and closed the matter without further action." } }, { "@type": "Question", "name": "Was safeguarding information involved?", "acceptedAnswer": { "@type": "Answer", "text": "An anonymous district nurse told the BBC the compromised systems contained highly sensitive safeguarding information relating to children and adults, including information connected to domestic abuse. The BBC was not able to independently verify those claims." } }, { "@type": "Question", "name": "Has the data been misused?", "acceptedAnswer": { "@type": "Answer", "text": "HCRG says there is no evidence the affected information has appeared online or been misused. One family told the BBC the children concerned had started receiving scam calls that they fear may be linked." } }, { "@type": "Question", "name": "How does offline storage change the outcome?", "acceptedAnswer": { "@type": "Answer", "text": "Records held on dedicated hardware with no standing network path cannot be browsed, copied or encrypted during a network intrusion, because there is no route to them. Access opens only through an authorised out-of-band request for a defined window, so retained records and archives remain untouched and recoverable." } } ] } ] ```