UK Councils Warn of Data Breach After Attack on Medical Supplier

In early April 2024, Nottingham Rehab Supplies (NRS) Healthcare, a key supplier of medical equipment to various UK councils, fell victim to a ransomware attack. This incident led to the company’s website being taken offline and raised concerns about the potential exposure of citizens’ personal data. Several councils, including East Lothian, Waltham Forest, Camden, and Buckinghamshire, have since reported that NRS informed them of possible data breaches affecting their residents.

The Breach Unfolds

The ransomware attack on NRS Healthcare has sent ripples through local authorities. East Lothian Council, for instance, stated on May 14 that specialist teams are investigating the extent of the attack, though they haven’t yet determined if any personal data has been compromised. Similarly, Waltham Forest Council acknowledged the breach on May 16 but couldn’t confirm whether residents’ data was affected. Camden Council has also been impacted but remains uncertain about the specifics of the data accessed. Buckinghamshire Council confirmed that personal data was breached due to the attack on NRS.

Ensure your data remains safe and accessible with TrueNASs self-healing technology.

Councils’ Response and Public Advisory

In response to the breach, affected councils have urged residents to remain vigilant against potential social engineering attacks. They advise caution with unsolicited emails, text messages, phone calls, and home visits. East Lothian Council, for example, reminded residents that official visitors will carry branded identification badges, which should be requested before granting access to homes. They also recommended that service users consider regularly changing their key safe numbers.

The Broader Picture of Data Breaches in UK Councils

This incident is part of a troubling trend of increasing data breaches within UK local authorities. In 2022, councils reported nearly 1,500 data breaches and over 600 lost or stolen devices. Suffolk County Council alone accounted for 651 incidents between September 2021 and September 2022. Such breaches expose sensitive personal information, including health records and financial details, leading to potential identity theft and fraud.

Financial Implications and Compensation

The financial repercussions of these breaches are significant. Councils have collectively paid out over £260,000 in compensation for data breach claims in recent years. For instance, Cheshire and West Cheshire Council has paid £185,000 since 2021, while Devon County Council has disbursed £86,000 over the same period. These figures underscore the pressing need for robust data protection measures.

Challenges in Data Protection

Local councils face several challenges in safeguarding personal data. Many operate on tight budgets, making investment in cybersecurity a challenge. Outdated IT systems may lack necessary security protections, and the lack of specialist cybersecurity staff means threats may not be detected in time. Employee training on data security may be inadequate, leading to human errors. The sheer volume of data increases the risk of data breaches, particularly if proper security measures are not in place.

The Path Forward

To address these challenges, councils must prioritize data protection. This includes investing in comprehensive training programs to educate employees about the importance of safeguarding data and the proper protocols to follow in case of device loss or theft. Councils should also modernize their IT systems to ensure they have the necessary security protections and consider implementing multi-factor authentication to enhance security.

References

• “UK Councils Warn of Data Breach After Attack on Medical Supplier.” Infosecurity Magazine, 17 May 2024. (infosecurity-magazine.com)
• “NHS supplier NRS Healthcare on verge of collapse.” Financial Times, 31 July 2025. (ft.com)
• “Councils suffer 1500 data breaches in 2022.” THINK Digital Partners, 20 April 2023. (thinkdigitalpartners.com)
• “UK councils are paying out a fortune in data breach claims.” IT Pro, 19 June 2025. (itpro.com)
• “UK councils admit security failings with 1500 data breaches declared in 2022.” IT Brief UK, 20 April 2023. (itbrief.co.uk)