Skip to content
OriginalSign in

DataBreachesDissent

HCRG Care Group hit by Medusa ransomware, patients angered

Part of the Medusa story · since 7 Oct 2025

Quiet for 11 weekslast report 19 Aug8 articles7 outlets
7 Oct · Security Affairs first20 Apr25 Jun30 AugNowThis article6th of 8
  • Tue 7 Oct, 20:20 UTC. Security Affairs, first report. GoAnywhere MFT zero-day used by Storm-1175 in Medusa ransomware campaigns.
  • Mon 10 Nov, 01:30 UTC. SecurityOnline, its first report on the story. MSP Nightmare: Medusa & DragonForce Exploit SimpleHelp RMM Flaws for SYSTEM Access.
  • Mon 10 Nov, 10:25 UTC. GBHackers, its first report on the story. Ransomware Operators Exploit RMM Tools to Deploy Medusa and DragonForce.
  • Tue 7 Apr, 08:11 UTC. The Hacker News, its first report on the story. China linked Medusa gang uses zero days to hit UK health, finance. Cites a CVE in CISA KEV.
  • Tue 7 Apr, 11:11 UTC. SecurityWeek, its first report on the story. Medusa Ransomware Hits 300+ Organisations After Zero Day Exploits.
  • Thu 18 Jun, 17:51 UTC. DataBreaches, its first report on the story. HCRG Care Group hit by Medusa ransomware, patients angered. This article, 6th of 8.
  • Tue 18 Aug, 20:30 UTC. DataBreaches. Medusa ransomware tallies hundreds of new victims, says updated advisory on group’s tactics.
  • Wed 19 Aug, 11:01 UTC. Infosecurity, its first report on the story. FBI Warns Medusa Ransomware Hits 500+ Critical Targets.

In February 2025, the Medusa ransomware gang claimed responsibility for a cyberattack on the UK healthcare provider HCRG Care Group. While HCRG initially confirmed a breach but offered limited details, the independent outlet SuspectFile revealed that a significant amount of personal and sensitive patient data, including information from 50TB of stolen data, had been compromised. Despite reports highlighting the breach, HCRG sought a court injunction against the publication of this data.

Meanwhile, a patient, John Adams, expressed frustration over delayed communication regarding the breach that took over a year to notify affected individuals. HCRG attributed this delay to 'uncertain details' and stated there was no evidence of data misuse. The incident was reported to the Information Commissioner’s Office (ICO), which is still investigating HCRG’s compliance with data protection regulations.

How the story developed

All 8 articles
Quiet for 11 weekslast report 19 Aug8 articles7 outlets

8 articles from 7 outlets since 7 Oct. Quiet since 19 Aug. This was the 6th report, 254 days after the first.

Now7 Oct73 Apr2917218421623926First reportSecurity Affairs · 7 Oct, 20:20This article6th of 8 · day 254
  • Tue 7 Oct, 20:20 UTC. Security Affairs, first report. GoAnywhere MFT zero-day used by Storm-1175 in Medusa ransomware campaigns.
  • Mon 10 Nov, 01:30 UTC. SecurityOnline, its first report on the story. MSP Nightmare: Medusa & DragonForce Exploit SimpleHelp RMM Flaws for SYSTEM Access.
  • Mon 10 Nov, 10:25 UTC. GBHackers, its first report on the story. Ransomware Operators Exploit RMM Tools to Deploy Medusa and DragonForce.
  • Tue 7 Apr, 08:11 UTC. The Hacker News, its first report on the story. China linked Medusa gang uses zero days to hit UK health, finance. Cites a CVE in CISA KEV.
  • Tue 7 Apr, 11:11 UTC. SecurityWeek, its first report on the story. Medusa Ransomware Hits 300+ Organisations After Zero Day Exploits.
  • Thu 18 Jun, 17:51 UTC. DataBreaches, its first report on the story. HCRG Care Group hit by Medusa ransomware, patients angered. This article, 6th of 8.
  • Tue 18 Aug, 20:30 UTC. DataBreaches. Medusa ransomware tallies hundreds of new victims, says updated advisory on group’s tactics.
  • Wed 19 Aug, 11:01 UTC. Infosecurity, its first report on the story. FBI Warns Medusa Ransomware Hits 500+ Critical Targets.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 8 articles as a list
  1. Tue 7 OctDay 01
    1. GoAnywhere MFT zero-day used by Storm-1175 in Medusa ransomware campaigns20:20 · Security Affairs · First report

  2. Quiet for 5 weeks

    Mon 10 NovDay 342
    1. MSP Nightmare: Medusa & DragonForce Exploit SimpleHelp RMM Flaws for SYSTEM Access01:30 · SecurityOnline · Picked up again
    2. Ransomware Operators Exploit RMM Tools to Deploy Medusa and DragonForce10:25 · GBHackers

  3. Quiet for 21 weeks

    Tue 7 AprDay 1822
    1. China linked Medusa gang uses zero days to hit UK health, finance08:11 · The Hacker News · Exploited CVE · Picked up again · Known exploited CVE
    2. Medusa Ransomware Hits 300+ Organisations After Zero Day Exploits11:11 · SecurityWeek

  4. Quiet for 10 weeks

    Thu 18 JunDay 2541
    1. HCRG Care Group hit by Medusa ransomware, patients angered17:51 · DataBreaches · Picked up again · This article, 6th of 8

  5. Quiet for 9 weeks

    Tue 18 AugDay 3151
    1. Medusa ransomware tallies hundreds of new victims, says updated advisory on group’s tactics20:30 · DataBreaches · Picked up again
  6. Wed 19 AugDay 3161
    1. FBI Warns Medusa Ransomware Hits 500+ Critical Targets11:01 · Infosecurity

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in