ACRO reprimanded following cyber security failings

What happened

The UK Information Commissioner’s Office issued a formal reprimand to ACRO Criminal Records Office for cyber security failings that allowed unauthorised access to its public website and CMS. The breach, occurring from August 2022 to March 2023, may have exposed names, DOB, addresses, NI numbers, passports, bank details and criminal offence data of up to 10,920 people. ICO found ACRO lacked clear responsibility for security updates, effective patch management and alert investigation. Mitigating factors included network segmentation and remedial actions taken by ACRO. No monetary fine was imposed.

Why it matters

Other organisations handling large volumes of sensitive personal data should audit who is accountable for security updates and ensure alerts are actively monitored, as basic cyber hygiene lapses can trigger regulator reprimands.

Business impact

Failure to assign clear patch‑management responsibility and to monitor security alerts can lead to regulator action and reputational damage, prompting investment in governance and technical controls.

Checklist

• Define responsibility for security updatesHigh priority

  Assign clear owners for identifying, assessing and applying patches across all systems and third‑party services.

• Monitor and act on security alertsHigh priority

  Implement processes to investigate, escalate and remediate security warnings promptly.

• Implement effective patch managementHigh priority

  Establish a documented vulnerability‑management program with regular testing and timely remediation.

• Strengthen network segmentationMedium priority

  Separate public‑facing services from core systems to limit lateral movement of attackers.

Who reported it

Discussion