Doncaster care provider Hesley Group reports cyberattack exposing staff data and financial info
Learn More
Hesley Group, a Doncaster-based care organization providing services for vulnerable individuals with complex needs, is reporting a cybersecurity incident that occurred in September 2024 and compromised sensitive personal information belonging to current and former staff members.
The data breach, was reported in August 2025. The organization claimms that criminals only accessed "some folders on our system and extracted a small amount of data," but the scope of potentially compromised information indicates a significant breach of staff privacy and data security.
Exposed data includes:
- Staff names and home addresses
- Employee photographs and identification images
- Personal phone numbers and contact information
- Email addresses and digital communication details
- Bank account details and financial information
- Salary information and compensation records
- Medical information and health-related data
- Employee onboarding documentation and forms
- Equal opportunities monitoring information
- DBS (Disclosure and Barring Service) background check records
- Internal administrative documents and personnel files
The nature of the attack and the number of affected individuals is not disclosed. The inclusion of DBS check information is very concerning as these background screening documents contain sensitive personal history data used to assess individuals' suitability for working with vulnerable populations.
The delay in reporting is not explained. The organization has completed its investigation and begun the process of notifying affected individuals whose data was potentially accessed during the breach.
The company has reported the incident to authorities including the Information Commissioner's Office (ICO), the National Cyber Security Centre (NCSC), and other relevant stakeholders including the Care Quality Commission (CQC).
As a precautionary measure, Hesley Group is providing affected staff members with subscriptions to identity monitoring services to help detect potential misuse of their personal information. The organization has also established one-to-one support services for people they care for, their families, and colleagues, including those not directly affected by the data breach.
