In August 2021, the Medical Specialist Group (MSG) suffered a cyberattack where hackers compromised its email server, exfiltrating thousands of sensitive patient health records. The breach remained undetected for over three months due to neglected security updates (unpatched for 13 months) and a flawed threat-detection system. The stolen data—including sensitive health information—was later exploited in phishing campaigns, violating data protection laws. The Office of the Data Protection Authority (ODPA) imposed a £100,000 penalty (£75,000 immediate, £25,000 conditional) for inadequate safeguards. While MSG claimed post-breach investments in security upgrades, staff training, and monitoring, the exact scale of exposed records remains undisclosed, though confirmed to be in the thousands. The incident underscores systemic vulnerabilities in healthcare cybersecurity, aligning with a broader trend of sector-wide attacks, such as the Anne Arundel Dermatology (2M patients affected) and McLaren Health Care (700K+ individuals) breaches.