Can You Claim Compensation for the NHS Trusts (Ivanti) Data Breach?

A cyberattack exploited vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), a widely used software tool for managing mobile devices. As a result, two NHS Trusts – University College London Hospitals and University Hospital Southampton – had data accessed without authorisation.

Ivanti discovered the critical vulnerabilities on 15 May 2025, and reports of the NHS Trusts being affected emerged on 28 May 2025.

The exposed data reportedly includes staff phone numbers, IMEI numbers (used to identify individual mobile devices) and authentication tokens (used to access internal systems).

While the full extent of the breach is still being assessed, experts warn sensitive patient records and medical data could also be at risk.

While the scale of the breach has not been confirmed, if you were treated at any of the hospitals managed by University College London Hospitals or University Hospital Southampton, your personal data could be compromised. Hospitals managed by these trusts include:

• Elizabeth Garrett Anderson Wing
• Hospital for Tropical Diseases
• Institute of Sport, Exercise and Health
• National Hospital for Neurology and Neurosurgery
• Royal London Hospital for Integrated Medicine
• Royal National ENT and Eastman Dental Hospitals
• University College Hospital
• University College Hospital at Westmoreland Street
• University College Hospital Grafton Way Building
• University College Hospital
• Macmillan Cancer Centre
• Southampton General Hospital
• Princess Anne Hospital
• New Forest Birth Centre
• Royal South Hants Hospital
• Lymington New Forest Hospital

If you are a patient of one of the affected Trusts and are concerned:

• Look out for direct communication from your NHS provider
• Be cautious of phishing emails, texts or phone calls
• Contact your NHS Trust’s Data Protection Officer or the Patient Advice and Liaison Service (PALS)
• Register with Join the Claim for updates

Patients have the right to hold organisations accountable when their sensitive information is mishandled. And, under UK data protection law, you may be entitled to compensation if your information was compromised due to inadequate security practices. 

We cannot say how much compensation you might get if you win your data breach case. Each claim is based on its merits and your solicitor will work to get the compensation owed to you.

In the UK, if a group of people have experienced loss, or otherwise been harmed by an organisation’s law breaking, they can come together to fight for justice. Levelling the playing field when standing up to big businesses, group actions prove that there is strength in numbers. At Join the Claim, we bring consumers and law firms together to ensure these group actions are as powerful as possible.

We won’t charge you a single penny. And we ensure any law firms we connect you with operate on a no-win-no-fee basis. If you win, the law firm will either take its fees from your compensation payment or recover these from the defendants.