CareTech Holdings (AIM:CTH), the group supporting those with disabilities and vulnerabilities, is coming under fire after its subsidiary and provider of care for vulnerable children, Cambian, was accused of mishandling a cyberattack, delaying informing those affected for months.
Operating approximately 2,000 children’s care homes, 36 specialist schools, 195 care homes, and a foster service, Cambian is alleged to have not promptly informed victims about a cyberattack it suffered in January.
Some individuals affected claimed they had to pursue the company for information and Chris Constance, a former principal of a Cambian school for autistic boys, said he only heard about the attack in August.
Constance told the Times: “The company appears to have downplayed the incident at the time and at no point did anyone try to contact me. On hearing of the breach, I emailed the managing director asking for clarity but initially received no acknowledgement.
“After further requests — I have now sent 15 emails — it was confirmed my payroll and bank details had been on the dark web since January. My personal breach also includes a number of very confidential emails regarding staff and students.”
Parents and staff also reportedly faced delays in receiving information, instead working out something had happened through “snippets of gossip” and the fact that schools’ IT systems were taken down.
While Cambian maintains that all affected individuals have been informed and measures were taken to ensure the safety of the online systems, various crime and cybersecurity organisations said they were aware of the attack, including the Information Commissioner's Office, which is currently making inquiries.
Experts from US cybersecurity firm Secureworks noted that AvosLocker, the ransomware gang, had listed Cambian as a victim, although no data had been discussed since May.
Legal action led by Keller Postman, representing approximately 100 alleged victims, is underway, with individuals claiming a lack of transparency and data security.