UK: More than one year later, HCRG is first notifying patients of ransomware attack

Medusa ransomware claimed a February 2025 breach of UK healthcare provider HCRG Care Group and provided patient data to media outlets; SuspectFile and DataBreaches reported on the leaks while HCRG sought a court injunction to block publication. Affected patients were notified more than a year later, prompting criticism and an ICO investigation amid speculation that the victim may have paid the gang to limit public disclosure.