HCRG Care Group

Profile narrative

HCRG Care Group operates as a private provider of health and social care services in the United Kingdom. The organisation was previously known as Virgin Care before undergoing a rebrand to HCRG Care Group. Its headquarters are located in the United Kingdom, reflecting its national focus. HCRG Care Group delivers a range of health and social care services to patients and service users across the country. As a private entity, it functions outside the public NHS framework while still providing contracted care services. The organisation's activities are centred on meeting health and social care needs within the UK market.

In February 2025, the Medusa ransomware gang claimed responsibility for stealing 2.275 terabytes of data from HCRG Care Group, asserting that the information included passport and driving licence scans, staff rotas, a birth certificate and background check data. The gang demanded a payment of two million US dollars, with an alternative extortion model of ten thousand US dollars per day to delay public release of the stolen data. Unlike typical ransomware attacks, Medusa did not encrypt systems but relied solely on data theft and extortion. HCRG Care Group confirmed that it was investigating the incident with external forensic specialists and reported no suspicious activity after implementing containment measures. Patient services were stated to continue operating normally throughout the response. Publicly available sources do not disclose the organisation's parent company, subsidiary structure or detailed ownership details.

Incidents

1 incident linked to this organisation.