What happened in the HCRG Care Group cyber attack?

In February 2025, HCRG Care Group confirmed it was investigating a cybersecurity incident after the Medusa ransomware group claimed it had accessed data from its systems. Reports said the group claimed to have taken around 2.3 terabytes of data and demanded a $2 million (£1.6 million) ransom.

The incident was reported to have affected large volumes of sensitive personal, medical and financial information. Reports also suggested around 500,000 patient records and 5,000 staff records may have been at risk.

What personal and medical data was compromised?

The type of information involved may depend on whether you were a patient, service user or employee.

Your own notification letter should explain what HCRG Care Group believes may have been involved in your case.

Medical history is classed as special category data under UK GDPR. This means it has a higher level of legal protection because of how sensitive it is.

When medical records, identity details, financial information or employment records are exposed, the impact can go well beyond inconvenience. It can affect your privacy, your confidence and your peace of mind.

If you’ve been affected, our specialist data breach claims team can help you understand whether you may be able to claim compensation.

The High Court injunction against ‘Persons Unknown’ explained

The High Court granted an injunction against the unknown individuals said to be responsible for obtaining data from HCRG’s systems between around 26 January 2025 and 12 February 2025. The order was aimed at restraining the disclosure or further use of confidential information.

An injunction is a serious court order. In this context, it shows that the information involved was considered highly sensitive and that there were real concerns about disclosure.

However, an injunction doesn’t undo the fact that data may already have been accessed or copied. It also can’t guarantee that information already distributed online or on the dark web will disappear.

That’s why affected people may still be worried about targeted phishing scams, identity theft, fraud and the ongoing distress of knowing private information may have been exposed.

How to document secondary harms to support your claim

If you want to start a compromised medical records claim in the UK, gathering the right evidence will help build the strongest possible case. Follow these steps to document how the breach has impacted you:

1. Keep a secure copy of your official notification letter or email from HCRG Care Group confirming your data was leaked.
2. Document all suspicious activity, such as a sudden rise in spam emails, targeted cold calls or unusual phishing text messages.
3. Keep detailed notes of any psychological impact, including sleeplessness, anxiety or visits to your GP regarding stress caused by the leak.
4. Reach out to Express Solicitors to begin your claim on a no win, no fee basis.

You don’t need to have everything before speaking to us.

Taking these steps can help our specialist team build a clearer picture of how the breach has affected you, including any distress, disruption or financial risk you’ve experienced since the incident.

What our clients say

See all reviews

Can you claim compensation after the HCRG Care Group cyber attack?

You may be able to claim compensation if your personal data was compromised and you suffered harm as a result.

That harm could include:

• Distress
• Anxiety
• Loss of sleep
• Loss of privacy
• Financial loss
• Fraud or attempted fraud
• Time spent dealing with the fallout
• Worry about identity theft or future misuse

Data breach compensation can cover two main types of harm:

• Material damage, which means financial loss
• Non-material damage, which means emotional harm, such as distress or anxiety

You don’t always need to have lost money to claim. The exposure of sensitive medical records, National Insurance numbers, financial details or employment information can cause serious distress in its own right.

Eligibility will depend on your circumstances, the information involved and the evidence available.

Start a no win, no fee HCRG Care Group data breach claim

A no win, no fee agreement means you don’t pay our legal fees if your claim is unsuccessful, subject to the terms of the agreement. If your claim succeeds, a success fee is deducted from your compensation. We’ll explain this clearly before you decide whether to go ahead.

A claim may involve:

• Confirming whether you were notified
• Checking what type of data was affected
• Understanding how the breach has affected you
• Reviewing any financial loss or distress
• Gathering supporting evidence
• Assessing whether data protection law may have been breached
• Contacting HCRG Care Group or its representatives
• Negotiating compensation where appropriate

Our data breach specialists will guide you through the process and keep things clear from the start.

Get in touch with our experts to begin

The HCRG Care Group cyber attack has left many patients, service users and staff worried about what information was accessed and what could happen next.

That worry may be even harder to deal with if you only found out many months after the incident.

If your private information was compromised, you may have the right to hold HCRG Care Group accountable and seek compensation for the impact it has had on you.

Express Solicitors can assess your case, explain your options and help you understand whether you may be eligible to claim.

Start your no win, no fee data breach claim today. Get in touch with Express Solicitors to speak to our specialist team.