THE ICO reprimanded the UK's Criminal Records Office (ACRO) following a data breach affecting over 10,000 individuals. The breach, which occurred from August 2022 to March 2023, was due to poor security practices, such as inadequate patch management and insufficient monitoring of security alerts. Sensitive personal information was exposed, including names, addresses, and criminal records.
The ICO recommended that organizations ensure accountability for security updates and enhance monitoring systems to better protect against cyber threats. Due to ACRO's remedial actions and existing network segmentation, they avoided a fine.