The UK's Information Commissioner's Office (ICO) has issued a reprimand to the Criminal Records Office (ACRO) following a 2023 data breach that compromised the personal information of over 10,000 individuals. The ICO's investigation identified significant security failures, including inadequate patch management and insufficient security monitoring, as contributing factors to the incident.
Between August 2022 and March 2023, an unauthorized actor gained access to ACRO's website and its Kentico content management system (CMS). While ACRO's record-keeping made it difficult to definitively confirm data exfiltration, the breach exposed sensitive details for 10,920 individuals. This information included names, dates of birth, addresses, National Insurance numbers, passport and driving license details, bank account information, biometric data, and highly sensitive criminal offense and special category information. The ICO noted that several complaints received by ACRO after the incident came from individuals associated with International Child Protection Certificates and victims of domestic violence.
The ICO's finding of GDPR infringement centered on two primary security deficiencies. First, ACRO demonstrated poor patch management. While its managed service provider (MSP) was responsible for operating system patches, the web development supplier was tasked with applying patches to the Kentico CMS but not identifying when they were needed. Crucially, ACRO itself failed to monitor for required security updates, creating a critical oversight gap.
Second, ACRO's security monitoring was deemed insufficient. Despite having a Trend Micro solution in place to detect and quarantine malware, the alerts generated by this system were not reviewed or acted upon. The ICO stated that timely investigation and response to these alerts could have prevented further malicious activity.
The ICO considered ACRO's existing network segmentation, which limited the attack's scope, and its subsequent remedial actions when deciding on a reprimand rather than a financial penalty. These actions included decommissioning the compromised infrastructure, migrating services, implementing enhanced security monitoring, improving cyber threat visibility, and strengthening network segmentation. The ICO's public sector approach typically limits financial penalties for such organizations.
Jonathan Balmforth, ICO group manager for civil and cyber investigations, emphasized the importance of clear accountability for security updates and effective monitoring. He stated that organizations must ensure responsibilities for identifying, assessing, and applying security updates are well-defined, and that security alerts are actively monitored, investigated, and escalated to prevent minor threats from escalating into major incidents. He concluded that having appropriate policies, responsibilities, and oversight is as crucial as deploying the right technology.
