The UK's criminal records office, ACRO, has received a regulatory reprimand from the Information Commissioner's Office (ICO) following security failures that potentially exposed sensitive data belonging to nearly 11,000 individuals. The incident, initially disclosed by ACRO in April 2023, involved persistent attacker access to their website and content management system for over seven months, with evidence suggesting data was staged for potential exfiltration.
The breach was uncovered in March 2023 during ACRO's investigation into a separate intrusion. While probing an SQL injection attack that compromised 15 sets of credentials, primarily belonging to ACRO staff, investigators discovered evidence of earlier intrusions dating back to July 8, 2021. The most significant incident involved ACRO's website and its Kentico content management system, where attackers maintained undetected access from August 5, 2022, until March 14, 2023.
A key finding by the ICO was that ACRO operated Kentico CMS version 12.0.0 from September 2019 until March 2023 without applying any patches or hotfixes released during that period. This left known vulnerabilities unaddressed. The ICO attributed this lapse to poor communication between ACRO and its managed service provider, noting that the supplier was unaware of its patching responsibilities until February 2020 and continued to assume it was not required to actively monitor for security updates.
The ICO stated that "the ambiguity around who was accountable for identifying necessary Kentico CMS patches created a gap where patches and hotfixes were missed, which ultimately left ACRO's website vulnerable." Furthermore, ACRO lacked a documented policy for patching Kentico CMS and could not demonstrate how vulnerabilities were identified or prioritized.
Compounding these issues, ACRO's Trend Micro antivirus generated security alerts that went unread. The office informed the ICO that it was "unable to establish what business processes existed for the assessment or handling of security alerts at the relevant time" and could not identify which roles were responsible for reviewing these alerts.
Due to ACRO's poor logging practices, a thorough investigation by a third-party cybersecurity firm could not definitively determine whether the affected data was exfiltrated. However, investigators confirmed that attackers staged data for possible exfiltration between February 15 and 16, 2023.
The potentially exposed information included Police Certificate Applications, Subject Access Request (SAR) forms, and International Child Protection Certificate forms. This data encompassed names, dates of birth, addresses, National Insurance numbers, passport and driving license details, bank account information, biometric data, and highly sensitive criminal offense and special category information.
Initially, ACRO notified 84,048 individuals about the breach. Subsequent investigation, however, determined that data relating to no more than 10,920 individuals had potentially been staged for exfiltration. The ICO received 35 formal complaints from affected individuals citing personal distress and concerns about identity theft and financial loss, including those connected to Police Certificates, International Child Protection Certificates, and victims of domestic violence. The ICO itself received an additional six complaints with similar concerns.
ACRO's network segmentation was identified as a mitigating factor, preventing attackers from moving beyond the compromised CMS into other systems. Since the discovery of the attack, ACRO has implemented several security enhancements. These include decommissioning the compromised infrastructure in June 2023, implementing a Security Information and Event Management (SIEM) system, improving visibility, monitoring, and network segmentation, hardening systems, and migrating to Salesforce Experience Cloud.
Jonathan Balmforth, group manager of civil and cyber investigations at the ICO, emphasized the importance of clear accountability for security updates and effective monitoring to identify and act on warning signs of cyberattacks. ACRO welcomed the reprimand and acknowledged the ICO's findings, stating that it has worked to strengthen its systems and safeguards since the incident, including immediately taking the previous website offline and subsequently decommissioning it.
