Police investigates data breach at multiple Northern Ireland GP Practices after hard drives go missing during IT upgrade
Learn More
Multiple medical practices across Northern Ireland, have been affected by a data breach after hard drives containing sensitive patient information went missing during an IT system upgrade.
The theft occurred at a medical practice on June 20, 2025. The data breach was caused by the actions of a Capita employee who was conducting hardware updates on behalf of the Northern Ireland Department of Health. Capita is a major outsourcing company that provides various contracted services to several Northern Ireland government departments, including IT support services.
According to patient notification letters sent out by affected practices, the Capita employee "did not follow correct procedure" during the IT upgrade process, resulting in the disappearance of storage devices containing sensitive patient information. Patients were only informed of the potential data compromise in late August 2025, nearly three months after the incident.
The exposed data includes:
- Patient names and addresses
- Phone numbers and contact information
- Dates of birth
- National Health Service (NHS) numbers
- Medical records and treatment histories
- Prescription information and medication details
- Health insurance and coverage information
- Family medical history records
- Appointment and consultation notes
The number of affected patients has not been disclosed by either the Department of Health or the affected GP practices. Officials have confirmed that the incident impacts "a small number of GP practices" throughout Northern Ireland. Given that even small GP practices typically serve hundreds to thousands of registered patients, and considering that multiple practices are involved, the total number of potentially affected individuals could range from several thousand to tens of thousands of patients.
The Police Service of Northern Ireland (PSNI) has confirmed it launched a criminal investigation.
