Processor Fined For Security Issues

The UK Information Commissioner's Office (ICO) has issued a fine against a processor for the first time, fining a software provider over GBP 3million for security failings that exposed the personal data of over 79,000 individuals.

The fine follows a ransomware attack in August 2022, where hackers accessed the health and care systems of a subsidiary of the provider. The access occurred through a customer account that lacked multi-factor authentication (MFA).

Key findings:

Impact

The attack disrupted critical services, including certain NHS services and compromised sensitive personal information, including details for access to people's homes for the provision of care services.