Esther Taylor, 47, of Bradford on Avon says she is "incredibly concerned" after learning her daughter's medical records were stolen in a February 2025 cyber attack on HCRG Care Group. HCRG says a third party gained temporary unauthorised access but claims there is no evidence the data has been misused and that it has reported the breach to law enforcement and the ICO. The provider offered a one-year identity monitoring subscription, which Taylor says is insufficient, and she has filed a formal complaint with the NHS.
Mother 'Incredibly Concerned' After Daughter's Medical Records Stolen in February 2025 Cyber Attack
Esther Taylor said her family had received no support [Dave Taylor]
Esther Taylor, 47, of Bradford on Avon in Wiltshire, says she is "incredibly concerned" after being informed this week that her daughter's medical records were stolen in a cyber attack that affected children's records in February 2025.
Taylor told Radio Wiltshire that the family received a letter just over a week ago notifying them of the breach. "Our initial reaction was obviously surprise but also huge concern for our daughter," she said. The letter made clear HCRG did not know exactly which items of personal data were compromised, leaving the family anxious about how the information might be used. "Somebody could impersonate our daughter," Taylor added.
HCRG Care Group, previously trading as Virgin Care, confirmed that a third party temporarily gained unauthorised access to its network in February 2025. In a written statement the group said it "acted immediately to contain and resolve the IT security incident," reported the matter to law enforcement and to the Information Commissioner's Office (ICO), which has since closed its consideration of the incident without taking further action.
HCRG Care Group said a third party temporarily gained unauthorised access to their network in February 2025 [Getty Images]
"There is no evidence that the affected information has appeared online or been misused," HCRG said, while adding it is providing what it describes as appropriate support to families identified as affected.
Taylor said HCRG told her family there was "no specific action" they needed to take and offered a complimentary one-year subscription to an online credit and identity monitoring service. She described that response as insufficient and said she had received "no support" from the provider. As a result she has lodged a formal complaint with the NHS over the decision to continue using HCRG services.
HCRG runs a range of NHS-funded community health and social care services across the west of England. The Bath and North East Somerset, Swindon and Wiltshire Integrated Care Board has been approached for comment but has not yet responded. The investigation into the breach was described by HCRG as "complex" and only recently concluded.
What parents should consider: Review any communications from HCRG, monitor official channels for updates, consider placing fraud alerts for affected family members, and contact HCRG or local NHS bodies for clarification about the scope of the breach and available support.
Help us improve.
