Acro Criminal Records Office

ico.org.uk • August 13, 2026

The Information Commissioner (the Commissioner) issues a reprimand to ACRO Criminal Records Office for infringements of Articles 32(1), 32(1)(b) and 32(1)(d) of the UK GDPR. This enforcement action follows a cyber incident in which the personal data of approximately 10,000 UK data subjects may have been affected.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ACRO Cybersecurity Failings Expose Data of Nearly 11,000 Individuals The UK's ACRO Criminal Records Office faced a reprimand from the Information Commissioner's Office (ICO) after a hacker gained unauthorized access to its website and content management system (CMS) from August 2022 to March 2023. The breach potentially exposed sensitive personal information of up to 10,920 individuals, including names, dates of birth, and biometric data. Despite the prolonged access, ACRO could not confirm if any data was exfiltrated. The ICO's investigation revealed poor patch management and inadequate monitoring of security alerts as key failings. ACRO had not applied necessary patches to its Kentico CMS, leaving it vulnerable. The ICO opted for a reprimand rather than a fine, citing mitigating factors such as network segmentation that limited the attack's impact. ACRO has since decommissioned compromised systems and implemented improved security measures. 7 sources 55

Extracted Entities

Acro Criminal Records Office

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)