Cyber attack on Doncaster care group hit by abuse scandal sees data stolen
A Doncaster care organisation at the centre of an abuse scandal by staff has had data stolen in a cyber attack, it has been revealed.
Hesley Group was targeted last September – but details of the incident have only just come to light after staff and former employees were emailed by bosses.
It is the latest in a series of problems for the organisation which was at the centre of four year police probe after it was discovered that 95 vulnerable children at three children’s homes run by the group faced "systemic and sustained" abuse and neglect from some staff.
Bosses have confirmed that hackers may have seized staff names and addresses, staff pictures, phone numbers, email addresses, bank details, salary details and medical information.
An email sent to former employees and seen by the Free Press, said: “In September 2024 Hesley was the victim of a cyber-attack.
"We had preventative security measures in place at the time but, unfortunately, the criminals responsible for attacking us were able to access certain parts of our systems.
"We immediately appointed external cybersecurity experts to investigate the attack against us.
"We also informed the Information Commissioner’s Office and the National Cyber Security Centre to ensure a robust and comprehensive response.
"We have been working tirelessly, with the support of external cybersecurity specialists, since the incident to investigate what happened, further strengthen our systems, and to understand what information might have been affected.
"Due to the nature of the incident, it has taken us some time to be able to fully investigate and understand what information might have been affected.
"We identified that, while those responsible for attacking us potentially accessed a section of our systems, only a much smaller proportion of information was actually taken by them.
"It has not been possible for our investigation to determine precisely what information was actually taken, but the evidence shows that most of the information that was potentially accessed was not in fact taken. “Following our investigations we can confirm that some information relating to you was contained in the section of our systems that was potentially accessed.
"Most of the relevant information relating to former Hesley Group colleagues is likely to be information contained in employee on-boarding forms, equal opportunities monitoring forms, DBS checks and related internal documents.
"This includes the following categories of information relating to you that may have been affected:
"Name, address, telephone number, email address, date of birth, employee ID, photograph, passport number, NI number, bank account details, information relating to salary, information relating to employment, information relating to education, information relating to ethnicity, information relating to criminal record, information relating to disability, information relating to gender, information relating to sexual orientation, information relating to narital status, information relating to medical status, information relating to medication and information relating to religion.”
"We have appointed expert third-party specialists to monitor the dark web following the incident for any signs that anyone has the information or any signs that it has been misused.
"Since September 2024 there has been no evidence of any of the information that was potentially accessed being misused, published or made available to anyone.”
A spokesperson for the Hesley Group said: “Hesley Group was the subject of a cyber incident last year.
"The breach thankfully had no impact on our ability to look after the people we support, but the criminals accessed some folders on our system and extracted a small amount of data.
“As soon as we found out, we appointed external cyber-security experts to investigate the incident and secure our systems.
"That investigation has now finished, and we have contacted the people who needed to be informed that their data was potentially accessed.
"We have also notified the ICO, the NCSC and other relevant stakeholders, including the CQC. There is no evidence of data relating to Hesley Group being published or misused on the dark web.
“We are offering one-to-one support for people we look after, their families and colleagues - including those unaffected by the data breach.
"As an extra precaution, Hesley is also providing those whose data was potentially accessed with a subscription to an identity monitoring service. Our priority remains looking after the people we support and our colleagues.”
In April this year its was revealed that staff accused of abusing children at several of Hesley’s special residental schools would not be charged following a four year investigation by South Yorkshire Police.
Investigations discovered internal reports of children being punched, kicked in the stomach and locked outside naked at the homes before they were shut in 2021.
South Yorkshire Police said it had commissioned an independent review into missed opportunities and would continue to investigate around a dozen cases.
The homes catered for children with severe disabilities and some users were non-verbal and living far away from home.
In June 2022, it was revealed that more than 100 reports of abuse and neglect had been recorded between 2018 and 2021 at the homes.
The abuse included children being fed chilli flakes, left in soiled clothes and having vinegar poured on cuts.
South Yorkshire Police and the local authority were also repeatedly warned about concerns.
The force said 11 cases would remain open in what had been an "incredibly complex and sensitive investigation".
Following the investigations, the Hesley Group said it had closed the homes, recognised that failings had been identified and was "deeply sorry" to those who had been affected.