ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Victim

ACRO Criminal Records Office

0 mentions in 7 days · 0 in 30 days · 2 total · first seen · last

Search everything

Timeline

ICO Reprimands Criminal Records Office After 2023 Breach

The UK ICO formally reprimanded ACRO Criminal Records Office over a 2023 breach caused by patching and security monitoring failures.

The UK Information Commissioner's Office issued a formal reprimand to ACRO Criminal Records Office following a breach in 2023. The regulator found failures in patching and security monitoring contributed to the incident. The action underscores regulator expectations for timely patching and monitoring at data-holding organizations.

Infosecurity Magazine · Aug 13, 2026Policy & legal

Three intrusions at UK criminal records office went undetected for two years

UK ICO reprimands ACRO criminal records office after three undetected intrusions over two years exposed thousands of records, including domestic violence victims.

The UK Information Commissioner's Office reprimanded ACRO Criminal Records Office after three intrusions between July 2021 and June 2023 exploited a Kentico customer portal unpatched since September 2019 and ignored Trend Micro antivirus alerts, including four quarantined Mimikatz detections. An attacker maintained persistent access for roughly seven months and staged data of nearly 11,000 people for exfiltration, though ACRO could not confirm exfiltration due to insufficient logging. ACRO notified more than 84,000 people on a precautionary basis; the Medusa ransomware group claimed the incident, and network segmentation kept attackers out of the Police National Computer.

The Record · Aug 12, 2026Data breach in the wild

Appears with

organization Information Commissioner's Office 2malware Mimikatz 1threat actor Medusa 1vendor ICO 1vendor Kentico 1vendor Trend Micro 1vendor ACRO 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.