November 27th 2025
Digital Care Hub, Cyber Centre of Excellence (CCOE) and Care England delivered the first of their series of webinars on ‘cyber in care’. The webinar issued stark warnings to social care providers about the ease with which attackers can breach poorly protected systems, often in minutes or even seconds. Speakers from CCOE, Kurtis Troy and DCH’s Sam Cattell, both experienced cybersecurity specialists and ethical hackers, walked attendees through real-world attack methods and urged organisations to overhaul password habits, improve staff training and adopt multi-factor authentication (MFA) as standard practice.
‘Hackers aren’t guessing—they’re using sophisticated tools’
Highlighting just how vulnerable many organisations still are, Kurtis explained that most cyberattacks begin with something as simple as a weak password or reused login details. He compared the process to “a more sophisticated game of Hangman”, where attackers combine password-cracking software with publicly available personal information to guess login credentials with alarming accuracy.
Password guidelines given during the session were clear: a minimum of 12–16 characters, unique to every account, and never containing personal details or dictionary words. Outdated advice to simply add capitals or punctuation at the end won’t help, the presenters warned, attackers already build these predictable patterns into their cracking tools.
Computing power is evolving—and cracking times are plummeting
One example demonstrated the effect of rising processing power. A password that would have taken months to crack in 2022 can now be broken in seconds. The presenters noted that this trend will continue, making long, randomised passwords and password managers essential.
Multi-factor authentication blocks almost all compromises
The speakers reiterated that MFA remains one of the single most effective defences against cybercrime, preventing an estimated 99% of account breaches. Using two or preferably three verification factors, something you know, something you have and something you are was described as equivalent to adding a second lock to a vulnerable front door.
Public Wi-Fi: ‘Never access banking or sensitive data’
Attendees were strongly cautioned against using public Wi-Fi—particularly in airports, train stations, and busy cafés. Attackers can intercept traffic or create fake networks to harvest login credentials. Hotspotting from a phone and enabling a reputable VPN were recommended as safer alternatives. “Never access banking information on public Wi-Fi,” Kurtis warned.
Social engineering becoming harder to spot
Phishing remains one of the most common ways criminals compromise accounts, and the presenters stressed that attacks are becoming more sophisticated, now extending beyond emails to Teams invites, WhatsApp messages, SMS (“smishing”) and even calendar appointments. With AI eliminating spelling errors and improving tone, identifying suspicious messages requires a “zero-trust approach”, treating every unsolicited request as dangerous until proven otherwise.
Live demonstration: cloning a website in minutes
Sam, Technical Cyber Lead, demonstrated how easily criminals can replicate legitimate websites and use them in phishing campaigns. In the example shown, he purchased a near-identical domain name, cloned a real website and added a secure HTTPS certificate, making it almost indistinguishable from the authentic version. Even trained users could be fooled unless a password manager flags the mismatch.
Attackers don’t need to target you personally
Modern cybercrime is largely automated, the speakers explained. Criminal groups scan the internet at scale looking for exposed systems, outdated software, or unsecured cloud services. Even small care providers often assuming they’re “too small to target” can be swept up simply because an attacker’s system detects an unpatched vulnerability.
Simple steps can stop most attacks
The webinar concluded with practical advice:
- Use long, unique passwords and a password manager.
- Enable MFA everywhere.
- Train staff regularly in phishing awareness.
- Avoid public Wi-Fi for work use.
- Keep devices updated and locked.
- Verify supplier cybersecurity credentials (e.g., Cyber Essentials, DSPT).
- Report suspicious emails to [email protected] and scam messages to 7726.
The presenters emphasised that while cyber risk is growing, organisations can dramatically increase their security through straightforward steps and that the greatest danger is assuming an attack “won’t happen to us”.
To watch the full recording of this webinar please visit our you tube channel here.
To sign up to the next 2 webinars in this series please visit here.
- 21st January, 12-1.40pm: Cyber in Care: The Deep, the Dark and the Hidden Dangers – Digital Care Hub
- 25th February, 12-1.30pm: Cyber in Care : Resilience, Recovery & Incident Response – Digital Care Hub
View all News