ACRO Criminal Records Office website and CMS compromise (2022-2023)

UK ICO reprimands the national criminal-records office over a seven-month website compromise; outsourced patching with no internal owner was the cause, and network segmentation is what capped the damage

The UK Information Commissioner's Office issued a reprimand to ACRO Criminal Records Office (the national policing body that runs criminal-record-check services) for infringing Articles 32(1), 32(1)(b) and 32(1)(d) of the UK GDPR, announcing it on 2026-08-12 against a formal record dated 7 August (ICO, 2026-08-12; ICO, 2026-08-07). Between August 2022 and March 2023 a hacker held unauthorised access to ACRO's public website and content management system and staged personal information for theft; ACRO could not conclusively determine whether it was removed. Up to 10,920 people may have been affected, and the ICO's list of potentially exposed fields is unusually broad for a website compromise: names, dates of birth, addresses, National Insurance numbers, passport and driving licence details, bank account information, biometric data, and criminal-offence and other special-category information, covering applicants for Police Certificates and International Child Protection Certificates, subject-access applicants, and third parties connected to those applications (ICO, 2026-08-12).

The finding is about ownership, not tooling. The ICO's investigation concluded that "ACRO did not ensure clear responsibility for identifying and monitoring critical CMS security updates, failed to maintain an effective patch management process, and did not adequately investigate security alerts that could have identified the hacker’s activity earlier" (ICO, 2026-08-12). The specific structural defect it names is that ACRO had engaged third-party providers to deliver security services including patch management, but engaging a provider is not the same as assigning the duty to notice that a critical update exists and confirm it was applied. That gap is what let a content management system stay exploitable long enough for an intrusion to run for seven months.

The mitigating half is equally concrete, and the ICO records it as one of the factors it took into account in deciding to issue a reprimand: "Network segmentation prevented the hacker from moving beyond the compromised website environment into core systems, reducing the potential scale of harm" (ICO, 2026-08-12). The regulator also credits ACRO's remediation, decommissioning the compromised infrastructure, migrating services elsewhere, implementing security monitoring, improving threat visibility and further strengthening segmentation. The ICO's own advice to other organisations is to make accountability explicit for identifying, assessing and implementing updates across all systems and suppliers; to ensure alerts are monitored, investigated and escalated; and to treat patch management, vulnerability management and regular testing as the primary defences.

The ICO names no CVE, no CMS product and no intrusion technique beyond unauthorised access to the website and content management system, so there is no detection content to derive here and none is invented. The published artefact is the causal analysis, not the tradecraft.