The Information Commissioner's Office has reprimanded ACRO Criminal Records Office after finding that failures in website maintenance and security monitoring put highly sensitive personal information at risk.
In its announcement on 12 August 2026, the regulator said a hacker gained unauthorised access to ACRO's website and content management system between August 2022 and March 2023. Information belonging to as many as 10,920 people may have been affected.
Personal information was prepared for possible theft
The attacker was able to collect personal information and stage it for removal from ACRO's systems. The organisation could not establish conclusively whether the information was actually taken, so the extent of any resulting disclosure remains uncertain.
The information potentially exposed included names, addresses, dates of birth, National Insurance numbers, passport and driving licence details, bank account information and biometric data. Criminal offence records and other special category information were also involved. Those affected included people applying for Police Certificates and International Child Protection Certificates, applicants making subject access requests and third parties connected to those applications.
The website compromise did not spread into ACRO's core systems. The ICO found that network segmentation, which separates different parts of an organisation's technology environment, prevented the attacker from moving beyond the affected website infrastructure. The regulator treated this as a mitigating factor when deciding how to respond.
Responsibility for security updates was unclear
The ICO's findings focus on how the website was managed as well as the attack itself. ACRO had engaged external providers to deliver security services, including patch management, but had not established clear responsibility for identifying and monitoring critical updates to its content management system.
The regulator also found that ACRO did not maintain an effective patching process and failed to investigate security alerts that could have revealed the attacker's activity sooner. Its message to other organisations is specific: responsibility for identifying, assessing and applying security updates needs to be clearly allocated across internal teams and external suppliers.
This distinction matters for organisations that rely on hosting companies, developers or ongoing website care. Purchasing a maintenance or security service does not by itself establish who monitors each component, who decides whether an update is urgent or who acts when monitoring produces a warning. Those responsibilities still need to be understood and managed.
ACRO has replaced the affected infrastructure
Following the incidents, ACRO decommissioned the compromised infrastructure and moved services elsewhere. The ICO also acknowledged improvements including stronger security monitoring, better visibility of potential threats and further network segmentation.
The reprimand is therefore about an earlier incident, but the regulatory finding is new. It provides a current example of how a public-facing website can become the route to highly sensitive information when maintenance responsibilities are divided but not clearly owned.
For organisations reviewing their own arrangements, the immediate question raised by the case is not simply whether somebody provides updates and monitoring. It is whether a named team or supplier is accountable for seeing each warning through from identification to action.
