Skip to content
You can now search across every topic, entity and event.What's new
Cybersecurity: Threats and Defences
5SEP

ICO reprimands ACRO over patching failures

2 min read
12:09UTC

Britain's data protection regulator reprimanded ACRO Criminal Records Office on 12 August after a website and CMS compromise put data on up to 10,920 people at risk. Remedial work spared it a fine.

TechnologyAssessed
Key takeaway

The ICO sanctioned unclear update ownership and ignored alerts, not the intrusion itself.

Britain's ICO, the Information Commissioner's Office, reprimanded ACRO Criminal Records Office on 12 August after a compromise of its website and content management system put data relating to up to 10,920 people at risk 1. ACRO is the UK police body that runs criminal record checks, including the certificates people need for visas and overseas employment, so the records in question describe who has and has not been convicted of what.

The regulator's findings name three failures: unclear ownership of critical updates to the content management system, ineffective patch management, and inadequate investigation of security alerts. None of those is an attacker capability. All three are questions about who inside an organisation is answerable for a piece of software, and the ICO's answer in this case was that nobody clearly was. Network segmentation and later remedial work counted as mitigation, so the regulator stopped short of a fine.

Enforcement on this beat usually points at the intruder. Two members of Scattered Spider were jailed at Woolwich Crown Court in July over the attack on Transport for London . A reprimand points the other way, at the organisation that held the data, and it does so on evidence that never needed a suspect to be identified: the patching record and the alert log were enough.

A reprimand carries no financial penalty, which is the standing criticism of the instrument, though it does put a named public body's patch-management practice on the regulator's published record. For any organisation reading it as a benchmark, the checkable question is not whether a patch policy exists. It is whether a named person owns updates to each internet-facing system, and whether anyone acted on the last alert the monitoring produced.

Deep Analysis

In plain English

ACRO Criminal Records Office issues criminal record checks used for jobs and visas in the UK. Its website was compromised, putting data on up to 10,920 people at risk. The UK's data regulator, the ICO, investigated and found ACRO had not kept its website software properly updated. The ICO issued a formal reprimand rather than a fine, because ACRO had already put technical barriers in place limiting how far the intrusion could spread, and had done remedial work since.

Deep Analysis
Root Causes

The ICO's reprimand cites unclear ownership of critical CMS updates as a root failure: when no single team is accountable for patching a content management system, updates lapse by default rather than by decision.

Network segmentation limited the compromise's reach after the fact, which is why the ICO stopped short of a fine, but segmentation is a containment control, not a fix for the unpatched CMS that let the intrusion start.

First Reported In

Update #13 · Four privileged platforms under live attack

Information Commissioner's Office· 5 Sept 2026
Read original
Different Perspectives
ENISA
ENISA
ENISA published an SME cyber-resilience maturity model on 6 August and updated the Cyber Resilience Act reporting-platform FAQ on 31 August. The agency supplies common implementation tools for smaller operators, but it cannot fine organisations that do not use them.
UAE Cyber Security Council
UAE Cyber Security Council
On 10 August, the UAE Cyber Security Council said national teams contained attacks on aviation, energy and education before objectives were reached. Its second monthly statement, after a 3 July financial-sector disclosure, makes public reporting of stopped attacks part of its operating posture.
South African authorities
South African authorities
INTERPOL said on 25 August that South African authorities made 39 arrests, seized US$2.67 million and blocked 257 accounts during Operation Jackal IV. Their share of the 23-country operation shows the material enforcement burden in a cross-border fraud case.
Europol
Europol
On 2 September, Europol announced the sinkholing of Sality after a 31 August operation involving US, Bulgarian, Hungarian and Romanian authorities. Its more than 11 million linked IP addresses measure infrastructure contact, not confirmed victims, and show why technical partners joined the action.
CISA
CISA
From 3 August to 2 September, CISA recorded three-day deadlines for 24 of 37 KEV additions, compared with 34 of 39 from 10 June to 29 July. The falling share changes the urgency signal that US federal agencies and private-sector tooling draw from the catalogue.
Beacon
Beacon
On 3 September, Beacon said its final report found that an intruder likely exported its customer database during roughly one hour and 27 minutes on 27 July. Charities using the CRM now have a named exposure route, a compromised AWS access key in public build artefacts.