NRS Healthcare, a provider of medical equipment (including wheelchairs and hoists) to the NHS and local councils, suffered a cyber security incident on 1 April 2024 when an unauthorized third party accessed its systems. The breach exposed personal and special category data of service users in East Yorkshire, Hull, and North Yorkshire, managed by NHS Humber & North Yorkshire ICB. The incident was reported to the Information Commissioner’s Office (ICO), with investigations involving the National Cyber Security Centre (NCSC) and police. The breach contributed to NRS Healthcare’s financial collapse, pushing it into receivership after a costly cyber attack and unprofitable contracts. While the NHS ICB was the service commissioner at the time, it no longer holds a contract with NRS. Affected individuals were warned about potential fraudulent activity stemming from the breach, with the NHS issuing an apology for the distress caused to patients and families. The exposed data’s sensitivity and the company’s subsequent failure highlight severe operational and reputational damage.