Exposed: Woeful security at UK criminal records office that led to sensitive data leak
The UK's criminal records office, ACRO, has escaped a fine and received a regulatory reprimand after security failings potentially exposed highly sensitive data belonging to nearly 11,000 people.
ACRO disclosed the "cybersecurity incident" in April 2023, and said at the time that it had no evidence to suggest that any data was compromised.
However, it has now emerged that attackers maintained persistent access to ACRO's website and content management system for more than seven months, and staged sensitive data for possible exfiltration.
According to the Information Commissioner's Office (ICO), which reprimanded ACRO rather than imposing a financial penalty, the breach was uncovered in March 2023 only because ACRO was investigating a separate intrusion.
Busting ICO enforcement jargon
The ICO has a few enforcement tools in its belt when it comes to data protection offenders.
Monetary penalties are pretty self-explanatory, but are reserved only for the very worst and most flagrant ...
Copyright of this story solely belongs to theregister.com. To see the full text click HERE
