Nobody Was Watching: How Britain’s Criminal Records Office Was Breached for Two Years Without Knowing It- 346
August 15, 2026
The office that safeguards some of the most sensitive data the British state holds, the criminal records of people applying for police certificates, child-protection clearances and visas, was breached repeatedly for almost two years, and learned of it only by accident. The Information Commissioner’s Office has reprimanded ACRO Criminal Records Office, the national policing unit that handles data drawn from the Police National Computer, after finding that attackers moved in and out of its public web portal between July 2021 and June 2023 through software left unpatched for nearly four years, while security alerts that might have stopped them went unread.
The entry point is unusually well researched. Victims The most serious intruder held persistent access for seven months and staged the records of almost 11,000 people for theft, among them victims of domestic violence; because ACRO kept too few logs, nobody can say whether the data actually left. No individual is blamed and no fine is imposed. The case is less a story about hackers than about accountability that belonged to everyone and therefore to no one.
The intrusions surfaced only because ACRO was investigating something else. In March 2023, while examining an SQL injection attack that had compromised fifteen sets of credentials, most of them belonging to its own staff, the office’s investigators found traces of separate intrusions reaching back to July 2021. The forensic report commissioned afterwards sorted the activity into three incidents, labelled Groups A, B and C, without establishing whether they were the work of different actors or successive stages of one campaign. All three exploited the same entry point: the public customer portal, built on the Kentico content management system. The most serious, Group A, began on 5 August 2022 and remained undetected until 14 March 2023, during which the attacker carried out reconnaissance and, on 15 and 16 February 2023, staged sensitive files for exfiltration. Evidence of attacker activity runs to 22 June 2023, though the ICO notes that this marks the decommissioning of the compromised infrastructure rather than the attackers’ last visit.
The root cause was organisational. ACRO ran version 12.0.0 of Kentico from September 2019 to March 2023 without applying any of the security patches and hotfixes the vendor released in that period. The ICO traced the failure to a gap between three parties, ACRO itself, its managed service provider and its web development supplier, none of which understood that it was responsible for watching for and applying updates; the managed provider did not even learn that patching fell to it until February 2020, and continued to assume it need not monitor for fixes. ACRO had no documented patching policy for the system and could not show how vulnerabilities were identified or prioritised. The same vacuum surrounded monitoring. Its Trend Micro security software raised repeated alerts during the attack period, including four quarantined attempts to install Mimikatz, a well-known credential-stealing tool, yet ACRO told the regulator it could not establish what process existed for handling alerts, nor which roles were meant to review and escalate them. The ICO concluded that, had the alerts been acted upon, further malicious activity could have been prevented.
What was at stake makes the lapse grave. The files staged for theft came from police certificate applications, subject access requests and International Child Protection Certificate forms, and included names, dates of birth, addresses, National Insurance numbers, passport and driving licence details, bank account information, biometric data and criminal offence and other special category information. ACRO notified 84,048 people on a precautionary basis in April 2023, covering everyone who had submitted applications during the window at risk; investigators later narrowed the potentially staged data to no more than 10,920 individuals. ACRO received 35 formal complaints citing distress and fear of identity theft and financial loss, from police certificate and child-protection applicants and from victims of domestic violence, and the ICO received six more.
The office’s handling of disclosure did not help: it first described the portal’s outage as essential maintenance, and admitted a cybersecurity incident only after being contacted by the Evening Standard. The Medusa ransomware group later claimed the attack, but never published any data, leaving it unknown whether a payment was quietly made or the claim was opportunistic.
One defence held. Network segmentation kept the attackers confined to the web environment and away from the core policing systems, which the ICO cited as a mitigating factor in choosing a reprimand, a formal warning with no financial penalty and a tool the regulator commonly uses for public bodies to avoid draining public funds, over a fine that could have reached £17.5 million or 4 percent of turnover. ACRO says it has decommissioned the old site, though only in June 2023, deployed a security information and event management system and launched a rigorously tested replacement. Yet the reprimand’s most revealing feature may be what it omits: it blames ACRO as an institution throughout, never a role or a manager, and redacts the names of the suppliers. A failure produced by diffuse responsibility has ended in diffuse accountability, which is precisely the condition that allowed it to persist for two years.
