Exposed: Woeful security at UK criminal records office that led to sensitive data leak
Nobody patched the CMS or read the alerts, and ACRO still cannot tell whether info was exfiltrated
The UK's Criminal Records Office (ACRO) avoided a fine but received a regulatory reprimand due to security failings that could have exposed sensitive data belonging to nearly 11,000 individuals. ACRO disclosed a cybersecurity incident in April 2023, stating no evidence of compromised data at the time. However, attackers maintained persistent access to ACRO's website and content management system for over seven months, staging sensitive data for possible exfiltration.
The Information Commissioner's Office (ICO) found attackers had been in the system since August 2022, exploiting known vulnerabilities due to ACRO's failure to apply patches and hotfixes. ACRO lacked a documented policy for patching Kentico CMS and could not identify roles responsible for reviewing security alerts. Despite an extensive investigation, it remains unclear if the affected data was exfiltrated.
ACRO notified 84,048 people about the breach, with 10,920 potentially being at risk of identity theft or financial loss. A spokesperson for ACRO accepted the ICO's findings and highlighted improvements made to bolster security since the incident.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
