---
schema: 1
kind: incident
title: "UK ICO reprimands the national criminal-records office over a seven-month website compromise — outsourced patching with no internal owner was the cause, and network segmentation is what capped the damage"
headline: "A regulator publishes the root cause of a government-body breach: patch management was contracted out, accountability for spotting critical updates was not"
summary: >
  The UK Information Commissioner's Office reprimanded ACRO Criminal Records Office on 2026-08-12 for
  UK GDPR security infringements after a hacker held access to its public website and content management
  system from August 2022 to March 2023 and staged the data of up to 10,920 people for theft — including
  National Insurance numbers, passport and driving licence details, bank account information, biometric
  data and criminal-offence records. The ICO's stated cause is governance rather than technology: ACRO
  had contracted patch management to third parties without establishing who internally was responsible
  for identifying and monitoring critical CMS updates, and did not adequately investigate security alerts
  that would have surfaced the intrusion earlier. Network segmentation kept the attacker out of core
  systems and the ICO names it among the mitigating factors it weighed.
discovered_at: "2026-08-13T05:08:00Z"
event_date: "2026-08-07"
run_id: 2026-08-13T0412Z-intel
priority: notable
immediate_action: null
tags: [data-breach, law-enforcement]
regions: [uk, europe]
sectors: [public-sector, legal-services]
entities: [incident:acro-criminal-records-office-cms-breach-2022]
techniques: [T1190, T1213]
affected_products: []
cves: []
sources:
  - url: "https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/08/acro-reprimanded-following-cyber-security-failings/"
    publisher: "UK Information Commissioner's Office"
    date: "2026-08-12"
    role: primary
  - url: "https://ico.org.uk/action-weve-taken/enforcement/2026/08/acro-criminal-records-office/"
    publisher: "UK Information Commissioner's Office"
    date: "2026-08-07"
    role: corroborating
closed_sources: []
evidence:
  - quote: "ACRO did not ensure clear responsibility for identifying and monitoring critical CMS security updates, failed to maintain an effective patch management process, and did not adequately investigate security alerts that could have identified the hacker’s activity earlier."
    publisher: "UK Information Commissioner's Office"
  - quote: "Network segmentation prevented the hacker from moving beyond the compromised website environment into core systems, reducing the potential scale of harm."
    publisher: "UK Information Commissioner's Office"
verification: single-source
sourcing_note: >
  Single-source: the ICO is the UK data-protection regulator publishing its own enforcement decision,
  so it is both the primary and the only assessor, and both cited pages are its own. This is not the
  national-CERT carve-out — a data-protection authority's enforcement action against a third party is
  neither a CERT advisory for its own jurisdiction nor a victim's own statement — so the entry ships as
  plain single-source, with reliability A reflecting the authority's first-party standing. The formal reprimand
  record is dated 2026-08-07 and the public announcement 2026-08-12; the full reprimand document is
  published only as a scanned PDF with no extractable text, so every claim here comes from the two
  HTML pages. The ICO names no CVE, no CMS product and no intrusion technique beyond unauthorised
  access to the website and content management system, and none is inferred.
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions: []
migrated_from: null
---

The UK Information Commissioner's Office issued a reprimand to ACRO Criminal Records Office — the national policing body that runs criminal-record-check services — for infringing Articles 32(1), 32(1)(b) and 32(1)(d) of the UK GDPR, announcing it on 2026-08-12 against a formal record dated 7 August ([ICO, 2026-08-12](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/08/acro-reprimanded-following-cyber-security-failings/); [ICO, 2026-08-07](https://ico.org.uk/action-weve-taken/enforcement/2026/08/acro-criminal-records-office/)). Between August 2022 and March 2023 a hacker held unauthorised access to ACRO's public website and content management system and staged personal information for theft; ACRO could not conclusively determine whether it was removed. Up to 10,920 people may have been affected, and the ICO's list of potentially exposed fields is unusually broad for a website compromise: names, dates of birth, addresses, National Insurance numbers, passport and driving licence details, bank account information, biometric data, and criminal-offence and other special-category information, covering applicants for Police Certificates and International Child Protection Certificates, subject-access applicants, and third parties connected to those applications ([ICO, 2026-08-12](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/08/acro-reprimanded-following-cyber-security-failings/)).

**The finding is about ownership, not tooling.** The ICO's investigation concluded that "ACRO did not ensure clear responsibility for identifying and monitoring critical CMS security updates, failed to maintain an effective patch management process, and did not adequately investigate security alerts that could have identified the hacker’s activity earlier" ([ICO, 2026-08-12](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/08/acro-reprimanded-following-cyber-security-failings/)). The specific structural defect it names is that ACRO had engaged third-party providers to deliver security services including patch management — but engaging a provider is not the same as assigning the duty to notice that a critical update exists and confirm it was applied. That gap is what let a content management system stay exploitable long enough for an intrusion to run for seven months.

The mitigating half is equally concrete, and the ICO records it as one of the factors it took into account in deciding to issue a reprimand: "Network segmentation prevented the hacker from moving beyond the compromised website environment into core systems, reducing the potential scale of harm" ([ICO, 2026-08-12](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/08/acro-reprimanded-following-cyber-security-failings/)). The regulator also credits ACRO's remediation — decommissioning the compromised infrastructure, migrating services elsewhere, implementing security monitoring, improving threat visibility and further strengthening segmentation. The ICO's own advice to other organisations is to make accountability explicit for identifying, assessing and implementing updates across all systems *and suppliers*; to ensure alerts are monitored, investigated and escalated; and to treat patch management, vulnerability management and regular testing as the primary defences.

The ICO names no CVE, no CMS product and no intrusion technique beyond unauthorised access to the website and content management system, so there is no detection content to derive here and none is invented. The published artefact is the causal analysis, not the tradecraft.

**Defender takeaway:** this is a regulator publishing, with an enforcement decision behind it, the two findings a European public-sector body can act on directly. First, an outsourced patching contract without a named internal owner for *noticing* critical updates is a control that reads as present on paper and is absent in practice — the question to ask of every managed-service arrangement is who is accountable for confirming a specific critical update reached a specific system, and where that confirmation is recorded. Second, the segmentation between a public-facing web estate and core systems is what decided the severity of this incident: the same separation that a Swiss cantonal or federal body maintains between its public web presence and its case-handling systems is precisely what the ICO credits with capping the harm here. Both are governance-layer questions that a SOC lead can pose without waiting for an incident to make them urgent — and the seven-month dwell time is the reminder that the alerting half of the failure is the one a SOC owns outright.