The UK’s data protection authority, the Information Commissioner’s Office (ICO), has reprimanded the Criminal Records Office (ACRO) following significant security oversights that resulted in a data breach affecting over 10,000 individuals. This incident, which occurred between August 2022 and March 2023, involved unauthorized access to ACRO’s website and content management system (CMS) by a hacker.
The ICO’s investigation has highlighted several critical failures in ACRO’s security protocols. Although the exact details surrounding the exfiltration of data remain ambiguous due to ACRO’s inadequate record-keeping practices, it has been confirmed that sensitive information was indeed compromised. The breached data included personal details such as names, dates of birth, addresses, National Insurance numbers, and information pertaining to bank accounts, as well as details from passports and driving licenses. Moreover, the breach exposed highly sensitive criminal offense information and data classified as special category information.
In the aftermath of the breach, numerous complaints were directed to ACRO. Many of these complaints originated from individuals linked to the International Child Protection Certificates program and from victims of domestic violence, shedding light on the potentially devastating implications of the compromised information.
The ICO’s findings indicated that ACRO fell short of compliance with the General Data Protection Regulation (GDPR). They outlined two main areas of negligence: poor patch management and inadequate security monitoring. ACRO’s managed service provider was responsible for installing operating system patches, but it failed to oversee the necessary updates for the Kentico CMS in use by ACRO. The web development supplier, tasked with patching the CMS, neglected to identify when updates were needed, leaving significant vulnerabilities unaddressed.
The ICO pointed out that ACRO itself did not actively monitor for security patch requirements, indicating a troubling lack of oversight on a crucial aspect of network security. This failure played a significant role in allowing the breach to occur.
Furthermore, the ICO report noted that although ACRO had implemented a Trend Micro solution designed to detect and quarantine malware, the alerts generated by this system were neither reviewed nor acted upon. The report suggested that had ACRO taken the alerts seriously and conducted timely investigations, the adverse effects of the attack could have been significantly mitigated.
In light of these events, the ICO’s reprimand took into consideration certain mitigating factors. ACRO had managed to implement network segmentation, which potentially limited the breadth of the attack’s impact. Following the breach, ACRO undertook several remedial actions. These included decommissioning the compromised infrastructure, migrating services to more secure locations, enhancing security monitoring mechanisms, and improving visibility concerning cyber threats.
Interestingly, it appears that ACRO may have avoided substantial financial penalties, which the ICO frequently imposes on private sector entities, due to the agency’s public sector context. The ICO typically adopts a more measured approach toward penalties in public organizations.
Jonathan Balmforth, the ICO’s group manager for civil and cyber investigations, emphasized the need for organizations to establish clear accountability in identifying, assessing, and applying security updates. He stated that effective monitoring is vital for swiftly detecting cyber threats, highlighting that the lessons learned from this incident revolve around the importance of sound policies, responsibilities, and oversight structures, in conjunction with robust technological measures.
In the report, the ICO provided valuable recommendations for other organizations to improve their security postures. Key advice included defining roles and responsibilities concerning security updates across all systems, ensuring that security alerts are actively monitored and investigated, and prioritizing effective patch and vulnerability management along with regular security testing.
The ACRO incident serves as a cautionary tale, underscoring the critical need for robust data protection measures in an increasingly digital world. Organizations are reminded that safeguarding sensitive information requires vigilance and a proactive approach to cybersecurity. By implementing the recommendations laid out by the ICO, organizations can better protect themselves against similar breaches, ultimately preserving the integrity of personal data and maintaining the trust of the individuals they serve.