ACRO reprimanded over cybersecurity failings
The ICO has reprimanded the ACRO Criminal Records Office after cybersecurity failings potentially exposed the personal information of up to 10,920 people, including criminal offence, biometric and special category data.
An attacker had unauthorised access to ACRO’s website and content management system between August 2022 and March 2023 and was able to stage information for removal, although ACRO could not determine conclusively whether the data had been extracted.
The regulator found that responsibility for identifying and monitoring critical security updates was unclear, patch management was ineffective and security alerts that might have revealed the intrusion earlier were not adequately investigated. Organisations using third-party security providers should confirm that responsibility for identifying, assessing and applying patches is expressly allocated and that alerts are actively monitored, escalated and resolved.
A Workshop on ‘Cybersecurity & Data Breach Prevention, Detection & Notification in AI-Enabled Organisations’ is taking place at PDP’s 25th Annual Data Protection Compliance Conference on 23rd, 24th and 25th September. See the website for further details.
