• The likely source has been identified as a phishing email sent to GenesisCare
• It appears the attacker’s motivations were to deploy software with malicious intent into our environment, which was unsuccessful due to our security measures. The attacker then proceeded to distribute a further mass email to a number of recipients, but only a small percentage were actually delivered
• There is no evidence to suggest that the recipient list has been sourced from any GenesisCare system. It is our belief that the recipient list was sourced from email addresses linked to previous data breaches (unconnected to GenesisCare) i.e. a dictionary attack
• Based on the above, we do not believe any data subjects to be at risk of serious harm as a result of the incident
• We will be taking a series of internal steps to mitigate the risk of a reoccurrence
• GenesisCare has already notified the ICO of the incident and has provided a further update following conclusion of our investigation
• We continue to urge any recipients of the email to follow the measures we outlined in our original announcement directly below

• A GenesisCare email account has been compromised
• An attacker has used the compromised email account to send a malicious email to around 5000 recipients
• The malicious email was sent on the 4th August 2025

At this moment in time, we are seeking further details to confirm how this incident occurred and steps we can take to mitigate it. We will continue to reassess the level of harm to the recipients of the email, and any other data subjects, as the investigation progresses.

There are some measures you can take to protect yourself from malicious activity:

• Do not click on links or download attachments from sources you do not trust
• Delete the malicious email which you have received
• Use strong, unique passwords for your accounts and change your passwords if you think you may have been compromised; and look out for phishing emails or fraudulent activity on your accounts

Updates to our investigation will be published on this page and we will consider any further notification requirements on an ongoing basis.

GenesisCare will be notifying the Information Commissioner’s Office of the incident.

If you have any particular concerns, please send them to dpo@genesiscare.co.uk

Thank you in advance for your patience whilst we conduct a comprehensive investigation.