Mum 'extremely worried' after child's data stolen

The mother of a child whose medical records were stolen in a cyber attack has said she is "incredibly concerned" about what information has been hacked and who has access to it.

Esther Taylor, from Bradford on Avon, Wiltshire, was told this week by healthcare provider HCRG that her daughter's data was stolen in February 2025 after a major breach of children's medical records.

The 47-year-old said she was "extremely worried" about how her daughter's information could be used. She said she had received "no support" from HCRG.

An HCRG Care Group spokesperson said there was "no evidence" information had appeared online or been misused and appropriate support was being provided to families affected.

The Bath and North East Somerset, Swindon and Wiltshire Integrated Care Board (ICB) has been contacted for comment but has yet to respond.

Taylor told Radio Wiltshire that she received a letter just over a week ago informing her that her daughter's personal data had been breached in a cyber attack in February last year.

"Our initial reaction was obviously surprise but also huge concern for our daughter," she said.

"The letter said they were not actually sure what information has been compromised so we are really concerned about what kind of information has been hacked and what kind of information is out there.

"Somebody could impersonate our daughter."

Taylor said HCRG had told them that there was "no specific action" they needed to take and had offered them a four-year free subscription to an online credit and identity monitoring service.

"I don't think this response is good enough," she said.

"We're incredibly concerned because the HCRG group continues to provide services to our children and we don't believe [our children's] information is safe with them anymore."

She has made a formal complaint to the NHS about the organisation's decision to use HCRG services.

Previously known as Virgin Care, HCRG runs a range of NHS-funded community health and social care services across the west of England.

In June, BBC News reported that patients were beginning to receive letters about the February 2025 data breach.

HCRG Care Group declined to be interviewed but in a statement it said it had "acted immediately to contain and resolve the IT security incident".

The statement said: "We reported it to law enforcement and the Information Commissioner's Office [and the] ICO has concluded its consideration of the incident and closed the matter without further action."

The group said there was "no evidence that the affected information has appeared online or been misused.

"The investigation was complex and has only recently concluded," it said.

"We contacted everyone identified as affected as soon as we had the facts needed to inform them accurately and are continuing to provide appropriate support."

Follow BBC Wiltshire on Facebook, X and Instagram. Send your story ideas to us on email or via WhatsApp on 0800 313 4630.