Advanced Computer Software

Advanced Computer Software was fined £3.07 million by the Information Commissioner's Office (ICO) in March 2025 for its 2022 data breach, in which absent Privileged Access Management (PAM) controls and an inadequate Active Directory tiering model enabled attackers to escalate privileges. The ICO decision treated the breach as a GDPR-standard failure precisely because NCSC guidance on PAM and AD tiering was already publicly available and not followed.

Advanced provides software and services to NHS trusts and care providers in the UK. Its 2022 breach disrupted NHS 111 and other health and care services across England. The ICO's investigation concluded that the absence of PAM controls was a directly causative failure, rather than a background factor; attackers gained persistence through a compromised account with access Advanced had not segmented or monitored.

The Advanced decision pre-dates the larger Capita fine (£14m, October 2025) and together they define the ICO enforcement template in which NCSC guidance constitutes the enforceable GDPR technical baseline. For any UK organisation subject to the ICO, the Capita–Advanced pair is the primary case law on what constitutes an adequate privilege management and AD architecture posture under Article 32 GDPR.