Three intrusions at UK criminal records office went undetected for two years
UK ICO reprimands ACRO criminal records office after three undetected intrusions over two years exposed thousands of records, including domestic violence victims.
The UK Information Commissioner's Office reprimanded ACRO Criminal Records Office after three intrusions between July 2021 and June 2023 exploited a Kentico customer portal unpatched since September 2019 and ignored Trend Micro antivirus alerts, including four quarantined Mimikatz detections. An attacker maintained persistent access for roughly seven months and staged data of nearly 11,000 people for exfiltration, though ACRO could not confirm exfiltration due to insufficient logging. ACRO notified more than 84,000 people on a precautionary basis; the Medusa ransomware group claimed the incident, and network segmentation kept attackers out of the Police National Computer.
- Three intrusions exploited an unpatched Kentico CMS portal unchanged since September 2019
- Trend Micro quarantined four Mimikatz attempts, but alerts went unread due to unclear responsibilities
- Group A attacker held persistent access for about seven months and staged data of nearly 11,000 people
- Medusa ransomware group claimed the April 2023 incident; no stolen data was ever published
- Network segmentation prevented access to the Police National Computer, per the ICO
- Vendors
- KenticoTrend Micro
- Threat actors
- Medusa
- Malware
- Mimikatz
- Victims
- ACRO Criminal Records Office
- Organizations
- Information Commissioner's Office
- Countries
- United Kingdom
From the original article
4 min read at therecord.media
Britain's criminal records office has been reprimanded by the country’s data protection regulator after being repeatedly breached over nearly two years, exposing the personal data of thousands of people including victims of domestic violence.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.