Guernsey medical practice sanctioned after cyber criminals access patient data through email account

Guernsey’s Data Protection Authority (ODPA) sanctioned First Contact Health after a phishing attack compromised an employee’s email account, exposing confidential health data; while reported in May 2024, unauthorized access likely began at least five months earlier, with investigators citing failures in four key security areas ([source](https://www.itv.com/news/channel/2026-02-13/physiotherapist-in-guernsey-sanctioned-over-data-protection-breach)).