--- title: Exposed: Woeful security at UK criminal records office... description: The UK's criminal records office, ACRO, received a regulatory reprimand from the ICO rather than a fine after security failings exposed highly sensitive data... canonical: https://daily.dev/posts/exposed-woeful-security-at-uk-criminal-records-office-that-led-to-sensitive-data-leak-zehm7fdxd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Exposed: Woeful security at UK criminal records office that led to sensitive data leak | daily.dev og:description: The UK's criminal records office, ACRO, received a regulatory reprimand from the ICO rather than a fine after security failings exposed highly sensitive data... og:url: https://daily.dev/posts/exposed-woeful-security-at-uk-criminal-records-office-that-led-to-sensitive-data-leak-zehm7fdxd og:image: https://api.daily.dev/og/posts/zEHm7FDXd.png og:image:alt: Exposed: Woeful security at UK criminal records office that led to sensitive data leak og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Exposed: Woeful security at UK criminal records office that led to sensitive data leak **[The Register](https://daily.dev/sources/theregister)** · 6 min read · 0 upvotes · 0 comments ## Summary The UK's criminal records office, ACRO, received a regulatory reprimand from the ICO rather than a fine after security failings exposed highly sensitive data on nearly 11,000 people. Attackers maintained undetected access to ACRO's website and Kentico CMS for over seven months in 2022-2023, exploiting unpatched vulnerabilities in a CMS version that went without patches for years due to confusion over patching responsibility between ACRO and its managed service provider. Antivirus alerts went unreviewed because no one was assigned to monitor them. Poor logging means investigators still cannot confirm whether data was actually exfiltrated, though staging of sensitive records including passport details, National Insurance numbers, bank information, and biometric data was confirmed. Network segmentation limited the damage to the CMS itself. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How long did attackers have undetected access to ACRO's website and CMS during the 2022-2023 breach? Attackers maintained persistent, undetected access to ACRO's website and Kentico content management system for more than seven months, from August 5, 2022 until March 14, 2023. The intrusion was only discovered because investigators were looking into a separate SQL injection attack that compromised 15 sets of credentials. _daily.dev surfaces incident writeups like this for teams building faster breach detection._ ### Why did ACRO's Kentico CMS remain unpatched for years before its 2023 data breach? ACRO ran version 12.0.0 of Kentico CMS from September 2019 to March 2023 without applying released patches and hotfixes because of ambiguity over whether ACRO or its managed service provider was responsible for patching. The supplier reportedly did not even learn patching was its responsibility until February 2020 and never actively monitored for security updates afterward. _Teams sorting out patch ownership between vendors and providers track cases like this on daily.dev._ ### What penalty did the ICO give ACRO for the 2023 criminal records data breach? The Information Commissioner's Office issued ACRO a reprimand rather than a financial penalty, reserving fines (up to £17.5 million or 4 percent of global turnover) for the most flagrant UK GDPR offenses. Reprimands are commonly used against public sector bodies to avoid depleting public funds, serving as a formal warning rather than a monetary sanction. _daily.dev helps security teams weigh how regulators like the ICO actually enforce data protection failures._ ## Similar posts on daily.dev - [Capita fined £14M after 58-hour delay exposed 6.6M records](https://daily.dev/posts/capita-fined-14m-after-58-hour-delay-exposed-6-6m-records-ixhphepvn) · The Register · 0 upvotes · 0 comments - [Hacker wipes Romania's entire land registry database](https://daily.dev/posts/hacker-wipes-romania-s-entire-land-registry-database-tdzwvjrkh) · Hacker News · 0 upvotes · 0 comments - [What organisations can learn from the record breaking fine over Capita’s ransomware incident](https://daily.dev/posts/what-organisations-can-learn-from-the-record-breaking-fine-over-capita-s-ransomware-incident-21wzllpky) · DoublePulsar · 0 upvotes · 0 comments - [Experts react as Department for Education cyber attack exposes 607,000 records](https://daily.dev/posts/experts-react-as-department-for-education-cyber-attack-exposes-607-000-records-sxxsbkgsk) · IT Security Guru · 0 upvotes · 0 comments --- Tags: [#data-breach](https://daily.dev/tags/data-breach), [#gdpr](https://daily.dev/tags/gdpr) [View this post on daily.dev](https://daily.dev/posts/exposed-woeful-security-at-uk-criminal-records-office-that-led-to-sensitive-data-leak-zehm7fdxd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Exposed: Woeful security at UK criminal records office that led to sensitive data leak","url":"https://daily.dev/posts/exposed-woeful-security-at-uk-criminal-records-office-that-led-to-sensitive-data-leak-zehm7fdxd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/exposed-woeful-security-at-uk-criminal-records-office-that-led-to-sensitive-data-leak-zehm7fdxd"},"datePublished":"2026-08-12T13:44:42.459Z","dateModified":"2026-08-12T13:45:14.809Z","description":"The UK's criminal records office, ACRO, received a regulatory reprimand from the ICO rather than a fine after security failings exposed highly sensitive data...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/80b24275ed259f6979b6a31fbe027d30?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/80b24275ed259f6979b6a31fbe027d30?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/exposed-woeful-security-at-uk-criminal-records-office-that-led-to-sensitive-data-leak-zehm7fdxd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"data-breach,gdpr","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Exposed: Woeful security at UK criminal records office that led to sensitive data leak"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/exposed-woeful-security-at-uk-criminal-records-office-that-led-to-sensitive-data-leak-zehm7fdxd#faq","mainEntity":[{"@type":"Question","name":"How long did attackers have undetected access to ACRO's website and CMS during the 2022-2023 breach?","acceptedAnswer":{"@type":"Answer","text":"Attackers maintained persistent, undetected access to ACRO's website and Kentico content management system for more than seven months, from August 5, 2022 until March 14, 2023. The intrusion was only discovered because investigators were looking into a separate SQL injection attack that compromised 15 sets of credentials. daily.dev surfaces incident writeups like this for teams building faster breach detection."}},{"@type":"Question","name":"Why did ACRO's Kentico CMS remain unpatched for years before its 2023 data breach?","acceptedAnswer":{"@type":"Answer","text":"ACRO ran version 12.0.0 of Kentico CMS from September 2019 to March 2023 without applying released patches and hotfixes because of ambiguity over whether ACRO or its managed service provider was responsible for patching. The supplier reportedly did not even learn patching was its responsibility until February 2020 and never actively monitored for security updates afterward. Teams sorting out patch ownership between vendors and providers track cases like this on daily.dev."}},{"@type":"Question","name":"What penalty did the ICO give ACRO for the 2023 criminal records data breach?","acceptedAnswer":{"@type":"Answer","text":"The Information Commissioner's Office issued ACRO a reprimand rather than a financial penalty, reserving fines (up to £17.5 million or 4 percent of global turnover) for the most flagrant UK GDPR offenses. Reprimands are commonly used against public sector bodies to avoid depleting public funds, serving as a formal warning rather than a monetary sanction. daily.dev helps security teams weigh how regulators like the ICO actually enforce data protection failures."}}]} ```