Organization

Information Commissioner's Office

0 mentions in 7 days · 2 in 30 days · 4 total · first seen Aug 12, 2026 · last 8d ago

Timeline4 articles

Welsh environment regulator's FoI blunder exposes diversity data of 2,000 staff

Natural Resources Wales inadvertently exposed diversity data of about 2,000 current and former staff via a 2021 Freedom of Information spreadsheet published online.

Natural Resources Wales confirmed equality monitoring data of roughly 2,000 employees who worked between April 2013 and March 2018 was inadvertently disclosed in a spreadsheet released in 2021 in response to a Freedom of Information Act request. The data may have included ethnicity, disability status, religion or belief, sexual orientation, Welsh language ability, and caring responsibilities — special category data under UK GDPR. The breach was reported to the Information Commissioner's Office, the data was removed and permanently deleted, and NRW says it has found no evidence of misuse. The issue was discovered only after a member of the public alerted the regulator on 23 August 2026.

The Register · SecuritySep 7, 11:04 UTC · 8d agoData breach

UK account-hack losses surge as new reporting system exposes hidden cases

UK reported account-hack losses rose 417% to £6.3M in 2025-26, largely because the new Report Fraud system is capturing previously hidden cases.

The City of London Police's first annual assessment reported £6.3 million in losses from hacked accounts in the year ending March 31, up from £1.2 million, with victims rising from 226 to 2,325. The surge coincides with the January launch of Report Fraud, which replaced Action Fraud; 92% of account-hack reports with financial loss were recorded in the second half of the year. Cyber-dependent crime reports rose 34% to 64,608 while ransomware reports fell 25% to 323, which police warn may reflect underreporting.

The RecordSep 4, 14:52 UTC · 11d agoPolicy & legal

ICO Reprimands Criminal Records Office After 2023 Breach

The UK ICO formally reprimanded ACRO Criminal Records Office over a 2023 breach caused by patching and security monitoring failures.

The UK Information Commissioner's Office issued a formal reprimand to ACRO Criminal Records Office following a breach in 2023. The regulator found failures in patching and security monitoring contributed to the incident. The action underscores regulator expectations for timely patching and monitoring at data-holding organizations.

Infosecurity MagazineAug 13, 08:30 UTC · Aug 13, 2026Policy & legal

Three intrusions at UK criminal records office went undetected for two years

UK ICO reprimands ACRO criminal records office after three undetected intrusions over two years exposed thousands of records, including domestic violence victims.

The UK Information Commissioner's Office reprimanded ACRO Criminal Records Office after three intrusions between July 2021 and June 2023 exploited a Kentico customer portal unpatched since September 2019 and ignored Trend Micro antivirus alerts, including four quarantined Mimikatz detections. An attacker maintained persistent access for roughly seven months and staged data of nearly 11,000 people for exfiltration, though ACRO could not confirm exfiltration due to insufficient logging. ACRO notified more than 84,000 people on a precautionary basis; the Medusa ransomware group claimed the incident, and network segmentation kept attackers out of the Police National Computer.

The RecordAug 12, 13:08 UTC · Aug 12, 2026Data breach in the wild

Appears with

victim ACRO Criminal Records Office 2 malware Mimikatz 1 organization City of London Police 1 organization National Cyber Security Centre 1 product Action Fraud 1 product Report Fraud 1 vendor ACRO 1 vendor ICO 1 vendor Kentico 1 vendor Natural Resources Wales 1 vendor Trend Micro 1 threat actor Medusa 1 victim Natural Resources Wales 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.