The UK’s data protection watchdog has issued a reprimand to the Criminal Records Office (ACRO) after multiple security failings led to a 2023 data breach which impacted over 10,000 people.
Between August 2022 and March 2023, a hacker gained unauthorized access to ACRO’s website and content management system (CMS), according to the Information Commissioner’s Office (ICO).
However, poor record keeping by ACRO means it remains unclear whether they ever exfiltrated the data on 10,920 victims, the ICO said.
Nevertheless, the breach exposed sensitive information including names, dates of birth, addresses, National Insurance numbers, passport and driving licence details, bank account information, biometric data, and “highly sensitive criminal offence and special category information.”
Among the dozens of complaints sent to ACRO following the incident, several were from those connected to International Child Protection Certificates, and victims of domestic violence.
Read more on ICO reprimands: ICO Reprimands Metropolitan Police for Data Snafu
The ICO’s ruling of GDPR infringement hinges on two main security failings: poor patch management and insufficient security monitoring.
ACRO’s managed service provider (MSP) took care of OS patches, but not those of the Kentico CMS it used, the ICO revealed. The policing agency’s web development supplier was responsible for applying patches to the CMS, but not identifying when patches were required, it added.
“ACRO itself did not monitor for required security patches, meaning that there was an absence of oversight for this important security control,” the ICO noted.
Second, although ACRO had a Trend Micro solution installed to “detect and quarantine malware,” the alerts it generated on doing so were “not reviewed or acted upon,” the report revealed.
“Had the alerts been investigated by ACRO at the time, and an appropriate response conducted, it is likely that further malicious activity could have been prevented,” it said.
ICO Advice for Other Organizations
In issuing a reprimand, the ICO took into account the fact that ACRO had network segmentation in place, which reduced the blast radius of the attack, and that it took remedial action.
This included “decommissioning the compromised infrastructure, migrating services elsewhere, implementing security monitoring, improving visibility of cyber threats and strengthening network segmentation.”
It is likely the agency escaped a fine due to the ICO’s public sector approach, which limits financial penalties levied on the sector.
“Organizations must ensure there is clear accountability for identifying, assessing and applying security updates. They must also have effective monitoring in place so that warning signs of cyber-attacks are identified, investigated and acted upon promptly,” said ICO group manager for civil and cyber investigations, Jonathan Balmforth.
“The lessons from this incident are clear. Having the right policies, responsibilities and oversight arrangements in place is just as important as having the right technology.”
The ICO’s advice for other organizations is to:
- Define who is responsible for identifying, assessing and implementing security updates across all systems
- Ensure security alerts are actively monitored, investigated and escalated so threats are identified before they become major incidents
- Get the basics right with effective patch and vulnerability management and regular security testing
