Added to basket
Are you sure?
Aesthetic clinics hold exactly the kind of things cybercriminals are looking for: money, personal data and sensitive patient information. Yet for many clinic owners, fraud and cybercrime can still feel like risks that belong to much larger organisations.
Speaking at Wigmore Presents 2026, retired Detective Superintendent Kenny Thomson challenged that assumption. Drawing on his experience leading economic crime and cybercrime units within Police Scotland, he explained why clinics are attractive to criminals and what businesses can do to protect themselves.
Kenny began by addressing some common myths: that it will never happen to you, that a clinic is too small to be of interest or that the police will recover any stolen money and arrest those responsible. Kenny was clear that the reality is very different. Fraud accounts for almost half of all reported crime in the UK, despite being significantly underreported. Once money has been transferred or data compromised, recovering it can be extremely difficult.
Clinics may not consider themselves obvious targets, but the information they hold makes them valuable. Patient records, payment details, clinical photographs and access to business funds can all be exploited. Criminals do not need to have a particular interest in a clinic or its patients. They simply need to see an opportunity.
One of the most familiar risks Kenny discussed was password security. When email addresses and passwords are exposed in a data breach, criminals test those same details across other services. Using one password for personal and professional accounts means a breach in one area can quickly provide access to another.
The same applies when clinics use third party systems to store patient information. The data may be held securely, but it can still be vulnerable if somebody’s login details are compromised. A business can have sophisticated systems in place, yet one reused password or convincing email may be enough to create an opening.
He also looked at ransomware. Criminals gain access to a business, encrypt its files and demand payment to unlock them. Even paying offers no certainty that the data will be returned. Information may also be copied, allowing criminals to demand a second payment to stop it being published or sold.
For clinics, the threat is particularly serious because patient data can include deeply personal information and before and after photographs. The damage can extend far beyond the initial attack, potentially leading to regulatory fines, legal action and a loss of patient trust.
Kenny also focused on the effect an incident can have on the people involved. An employee who clicks a malicious link may feel personally responsible for what follows, while the clinic owner is left managing the financial, operational and reputational consequences.
His advice was practical. Everyone within a clinic should receive basic training on the risks, how to recognise them and what to do if something goes wrong. Clinics should also have clear policies and a response plan in place." Everyone within a clinic should receive basic training on the risks... "
If a clinic owner arrived on Monday morning to find every file encrypted, would they know who to call? What would they tell their employees, patients and suppliers? These questions are much easier to answer before an incident occurs.
As Kenny put it, “A criminal only needs to be successful once. You need to be successful every time.”
Cybersecurity is not simply an IT issue. It requires leadership, regular conversations and a shared understanding that everybody has a role to play. For clinics built on patient confidence, protecting personal information is ultimately part of protecting the patient relationship itself.
