Care homes have changed a great deal in the last few years. Care plans, medication records, rotas and messages to families now live on tablets, laptops and cloud systems. That brings real benefits for residents and staff, but it also means a cyber attack can do real harm: locking staff out of care records, exposing sensitive information about the people you look after, or stopping the home running smoothly.
Here’s why care providers are a target, what the rules expect, and the practical steps that make the biggest difference.
How common are cyber attacks?
The UK government’s latest Cyber Security Breaches Survey, published in April 2026, found that 43% of businesses and 28% of charities had a cyber security breach or attack in the previous 12 months. Around 85% of the businesses affected said it involved phishing: fake emails, texts or calls designed to trick someone into clicking a link, handing over a password or paying a bogus invoice.
The survey also found that only 15% of businesses check the cyber security of their direct suppliers, even though a weakness at a supplier can affect everyone who uses them.
Why criminals target care providers
- Valuable information. Care homes hold health and care records, medication details and staff bank details. Criminals can sell this data or demand a ransom for it.
- Systems that can’t be down. A home that can’t reach its care records needs them back fast, which criminals hope makes it more likely to pay.
- Busy, changing teams. Shift work, agency staff and shared devices make it easier for a convincing scam email to get through, or for an old account to be left active.
- Connected suppliers. Care software, pharmacy ordering systems and IT providers all connect to your home. A weakness anywhere in that chain can affect you.
- Limited IT support. Many smaller providers don’t have in-house IT staff, so security can fall behind.
Large organisations are affected too. In February 2025, HCRG Care Group, one of the UK’s largest independent providers of community health and care services, confirmed it was investigating a cyber attack after a ransomware gang claimed to have stolen more than two terabytes of data and demanded a $2 million ransom.
What the Data Security and Protection Toolkit expects
The Data Security and Protection Toolkit (DSPT) is the NHS’s online self-assessment for data and cyber security. For adult social care providers it is the standard way to show you look after information properly, and you need to complete it before you can apply for an NHSmail account. Submissions are due by 30 June each year.
Take-up is growing. By July 2026, around 76.5% of CQC-registered adult social care services in England had an up-to-date DSPT, and the CQC has said it strongly recommends that all providers use it.
The 2025/26 toolkit added two new mandatory requirements for care providers: a register of your devices, software and the data you hold, and signed agreements for anyone with administrator access to your systems. Other areas where care homes commonly get stuck are keeping training records up to date for every member of staff, and testing their business continuity plan each year.
Eight practical steps to protect your care home
- Turn on multi-factor authentication. Requiring a code from a phone as well as a password stops most attacks that rely on stolen passwords. Start with email and any administrator accounts.
- Give everyone their own login. Avoid shared accounts and passwords, and remove access promptly when staff or agency workers leave.
- Keep devices and software up to date. Install security updates quickly and replace computers, tablets and routers that no longer receive them.
- Train staff to spot scams. Short, regular training helps everyone recognise phishing. Include agency staff, and make it easy for people to report something suspicious without fear of blame.
- Back up your data and test it. Keep at least one backup separate from your main systems so it can’t be encrypted in an attack, and check that you can actually restore from it.
- Separate your Wi‑Fi. Keep resident and visitor Wi‑Fi apart from the network used for care systems and office computers.
- Know your suppliers. Keep a list of who has remote access to your systems, and ask your software and IT suppliers how they protect your data.
- Plan for the worst. Agree how care would continue if systems were unavailable, including paper fallbacks for medication and care notes, and practise it once a year. If personal data is breached, you may need to report it to the Information Commissioner’s Office within 72 hours.
A good place to start: Cyber Essentials
Cyber Essentials is a government-backed certification that covers five basic security controls: firewalls, secure settings, controlled user access, malware protection and keeping software up to date. Working towards it is a practical way to cover the basics, and it supports many of the requirements in the DSPT.
There is also free help for the sector. Better Security, Better Care is the official support programme for adult social care, with guidance and local support to help providers complete the DSPT. In the West Midlands, local support is provided by the West Midlands Care Association.
How Shadow Support can help
We provide IT support for nursing and care homes across Solihull, Birmingham and the West Midlands. We can help with the technical side of the DSPT, set up multi-factor authentication and secure Wi‑Fi, monitor and update your systems, look after your backups and train your staff to spot scams. For care homes, our support is available 7 days a week.
If you’d like a review of your care home’s cyber security, book a free consultation or call us on 0121 709 4646.
Sources: The Register on the Cyber Security Breaches Survey 2025/26, Care Management Matters, TechCrunch, Department of Health and Social Care.
