|
Dear colleagues,
The LGA has become aware of a significant cyber security incident involving HCRG Care Group (formally known as Virgin Care), a major provider of community health and care services in the UK.
Background
HCRG Care Group is currently conducting an investigation into a ransomware attack. Despite maintaining service continuity and successfully eradicating the threat, a significant risk remains that sensitive data, potentially including personal information pertaining to vulnerable service users, has been exfiltrated and may be published on the dark web.
Actions and advice
We understand many of you are aware of the HCRG incident and its potential implications. Whilst there are some facts we can share, there remains a lot of uncertainty. There are likely to be some local authorities directly impacted and other involved as part of a multi-agency response. Some may not be impacted at all. The LGA would advise all councils with recent or historic contracts with HCRG that involve the sharing of sensitive data to:
- Ensure you are appraised of the situation, and work as an organisation, involving your Data Protection Officer to assess potential risks based on data shared with HCRG.
- Notify the ICO independently if you suspect a data breach or potential breaches data.
- Follow situational updates and continue to update your risk assessment.
- Develop risk mitigation plans for how you will deliver your safeguarding duties, if and/or when you feel they are required.
- If you are/ were using HCRG in partnership with other local organisations e.g. health or police teams, you should reach out to them in case multi-agency response arrangements are needed to calculate risks, and agree actions.
All the usual guidance applies from regulators and government bodies. The following might be helpful:
Given the dynamic nature of this incident, councils are advised to seek information directly from HCRG; please share any intelligence you think useful in developing a national picture including whether you believe your council to be impacted.
The LGA will continue its engagement with government, bodies such as the Association for the Directors of Children’s and Adults Social Services (ADASS and ADCS) and multi-agency partners.
To facilitate a comprehensive national understanding and coordinate a response where necessary, please report any arising issues and intelligence CyberandDigital@local.gov.uk.
Many thanks,
Joanna Killian
LGA Chief Executive |
|
 |
|
