Britain’s criminal records office has been reprimanded by the country’s data protection regulator after suffering three separate cyberattacks that went undetected for nearly two years, exposing the personal data of thousands of people — including victims of domestic violence.
The Information Commissioner’s Office (ICO) issued a formal reprimand against ACRO Criminal Records Office, the national policing unit that manages sensitive data held on the Police National Computer. All three intrusions — between July 2021 and June 2023 — exploited the same public-facing customer portal, which had been running on an unpatched version of the Kentico content management system since September 2019. Despite Kentico releasing security fixes for documented vulnerabilities in that software, ACRO applied none of them because no one — ACRO, its managed service provider, or its web development supplier — knew who was responsible for watching and applying patches. The most serious incident, dubbed Group A by forensic investigators, saw attackers maintain persistent access for approximately seven months, staging data on nearly 11,000 individuals for potential exfiltration. Trend Micro antivirus alerts, including four separate detections of Mimikatz credential-harvesting activity, all went unread. ACRO told the ICO it could not identify what business process existed for handling security alerts, or which roles had been responsible for them. On a precautionary basis, ACRO notified more than 84,000 people whose data was in the system during the at-risk window. The Medusa ransomware group later claimed responsibility, though no stolen data was ever published on its leak site. The ICO noted that network segmentation prevented attackers from reaching the core policing system, which it cited as a mitigating factor in its decision to issue a reprimand rather than a financial penalty.