Every October, organisations around the world mark Cyber Security Awareness Month as a chance to reflect, reinforce and re-energise their defences. But in 2025, the message could not be more urgent.
Recent high-profile hacks have shattered assumptions about who can be attacked. The recent Jagtuar Land Rover cyber incident forced production shutdowns and left suppliers exposed. Meanwhile, the UK nursery chain “Kido” was breached, with the personal details, photographs and safeguarding information of children published in a ransom demand.
These events send a stern warning: no organisation is too trusted, too niche or too small to be targeted. And for providers of adult social care and supported living, cyber security is about protecting dignity, trust and safety.
Why care providers face unique risks
- Highly sensitive data: Care records include health, wellbeing, safeguarding, behavioural and personal history. A breach can expose more than just names and dates. It can reveal vulnerabilities and deeply personal circumstances.
- High duty of care: Service users, families, regulators and commissioners have expectations about security; trust is central to your mission.
- Regulatory & reputational fallout: Beyond legal penalties under GDPR/UK GDPR, breaches can erode public trust, invite compliance investigations and put your relationships with clients and funders at risk.
- Target vector via third parties: Many providers use external tools (e.g. scheduling, systems, data platforms). Attackers often exploit the weakest links in the supply chain or vendor networks.
This is not a drill. This is real.
Cyber Security Awareness Month presents a practical opportunity. It is a fixed moment in time when teams are focused, senior leaders can show commitment and plans can be accelerated.
Here’s how to make it count:
Practical Steps to Lock Down Data in Supported Living Settings
1. Leadership alignment & risk review
- Start by assessing your current posture: what systems hold personal data, who has access, where are gaps?
- Engage leadership to allocate resources because security is rarely “free” in time or money.
2. Access control & identity hygiene
- Enforce least privilege protocols: staff should only see data which is relevant to their role.
- Use multi-factor authentication (MFA) everywhere, especially for remote or sensitive access.
- Enforce strong password rules / passphrases; regularly expire or rotate credentials.
3. Encrypt data at rest & in transit
- All databases, backups and file stores should use strong encryption.
- Use secure communication channels (e.g. TLS) when data moves between systems, apps or APIs.
4. Patch, update, monitor
- Keep all software (OS, applications, server software) up to date with security patches.
- Use intrusion detection / logging tools which alert on anomalous behaviour.
- Continuously monitor logs; investigate unusual patterns early.
5. Vendor & third-party risk control
- Vet providers for their security standards (e.g. ISO 27001, SOC2).
- Use contracts which require incident response, notification obligations, audits.
- Limit vendor access to only what is necessary, and isolate vendor systems where possible.
6. Staff training & phishing simulations
- Run repeated, bite-sized training sessions, especially oriented to care teams who may not be tech natives.
- Simulate phishing attacks tailored to your context (e.g. “click this link to see a new rota”) to test vigilance.
- Reinforce policies: “If in doubt, don’t click,” and clear escalation paths.
7. Incident response & readiness
- Document a clear, tested incident response plan: who does what, how to contain, who to notify (ICO, users), how to recover.
- Practice tabletop exercises to rehearse real-world scenarios.
- Ensure resilient backups (off-network, versioned) and disaster recovery routes.
8. Communicate transparently
- If a breach occurs, be swift and open. Clearly explain what happened, which data may be affected and what steps you are taking.
- Maintain regular updates to stakeholders (service users, families, regulators) to preserve trust.
Seize the Moment This October: Action Over Awareness
Cyber Security Awareness Month should mean more than a website banner and a few token emails. It is a serious potential catalyst for action. Use it to accelerate maturity, test weaknesses and embed good habits. Because when the next attack hits (and recent history suggests it almost certainly will) the organisations which recover fastest are those who did the work before the sirens sounded.