Privacy Unpacked
Menu

After the breach

What regulators did about data breaches

Fines, reprimands and orders from data protection regulators after breaches and security failures · updated daily

Actions after breaches, 12 months
13
Fines among them
3
Fined in total
£2,439,773

In the last 12 months: 9 reprimands, 3 monetary penalties, 1 enforcement notice. A reprimand is a formal finding that the law was broken, with no fine.

Every action after a breach, newest first

  1. Reprimand · UK Information Commissioner’s Office · Staffordshire Police
    Staffordshire Police has been issued with a Reprimand, after the force unlawfully disclosed a domestic abuse victim's home address to their alleged abuser, within a Domestic Violence Protection Notice ("DVPN"). The decision
  2. Reprimand · UK Information Commissioner’s Office · Ogi Networks and Data Cymru
    Welsh organisation reprimanded after cyber-attack exposed children’s information. The decision
  3. Reprimand · UK Information Commissioner’s Office · Local Government Data Unit - Wales
    Welsh organisation reprimanded after cyber-attack exposed children’s information. The decision
  4. Reprimand · UK Information Commissioner’s Office · ACRO Criminal Records Office
    The Information Commissioner (the Commissioner) issues a reprimand to ACRO Criminal Records Office for infringements of Articles 32(1), 32(1)(b) and 32(1)(d) of the UK GDPR. This enforcement action follows a cyber incident in which the personal data of approximately 10,000 UK data subjects may have been affected. The decision
  5. Reprimand · UK Information Commissioner’s Office · Chief Constable Commissioner for the Metropolis/ Metropolitan Police Service (MPS)
    Incident 1 (ICO Ref: INV/0034/2025), concerning the service of unredacted documents in support of a Stalking Protection Order application; and Incident 2 (ICO Ref: INV/0138/2024), concerning the disclosure of email addresses when contacting victims of the Honeytrap Matter. The decision
  6. Enforcement notice · UK Information Commissioner’s Office · Chief Constable Commissioner for the Metropolis/ Metropolitan Police Service (MPS)
    Incident 1 (ICO Ref: INV/0034/2025), concerning the service of unredacted documents in support of a Stalking Protection Order application; and Incident 2 (ICO Ref: INV/0138/2024), concerning the disclosure of email addresses when contacting victims of the Honeytrap Matter. The decision
  7. Reprimand · UK Information Commissioner’s Office · Suffolk Constabulary
    Suffolk Constabulary has been issued with a Reprimand, after sensitive personal data became inadvertently disclosed within Excel spreadsheets, in response to Freedom of Information requests. The decision
  8. Reprimand · UK Information Commissioner’s Office · Norfolk Constabulary
    Norfolk Constabulary has been issued with a Reprimand, after sensitive personal data became inadvertently disclosed within Excel spreadsheets, in response to Freedom of Information requests. The decision
  9. Monetary penalty: £963,900 · UK Information Commissioner’s Office · South Staffordshire Plc and South Staffordshire Water Plc
    The Information Commissioner’s Office (ICO) has imposed a fine of £963,900 on South Staffordshire Plc & South Staffordshire Water Plc for the infringement of Article 5(1)(f) and Article 32(1) of the UK General Data Protection Regulation. This enforcement action follows a cyber incident in which personal data relating… The decision
  10. Monetary penalty: £247,590 · UK Information Commissioner’s Office · MediaLab.AI, Inc.
    £247,590 penalty imposed on MediaLab.AI, Inc. in respect of infringements of Articles 5(1)(a), 6, 8 and 35 UK GDPR. MediaLab operated the Imgur social media platform in the UK prior to 30 September 2025 and allowed children under the age of 13 to access the platform, purportedly subject to a requirement for parental… The decision
  11. Reprimand · UK Information Commissioner’s Office · Staines Health Group
    Reprimand Issued - Staines Health Group sent excessive medical details about a terminally ill patient to their insurance company. The patient requested that five years of medical records be sent to them to review, before being sent to the insurer in order to progress the claim. But, instead of five years medical… The decision
  12. Reprimand · UK Information Commissioner’s Office · Post Office Limited
    On 25 April 2024, Post Office Limited (POL) uploaded an unredacted copy of a legal Settlement Deed to its corporate website instead of the intended redacted version. The Settlement Deed contained the personal data of 502 claimants who were part of the 2017 group litigation brought against POL which exposed the… The decision
  13. Monetary penalty: £1,228,283 · UK Information Commissioner’s Office · LastPass UK Ltd
    £1,228,283 penalty issued to password management provider LastPass UK Ltd on 20 November 2025 in respect of infringements of Article 5(1)(f) and Article 32(1)(f) UK GDPR. LastPass' failure to implement appropriate technical and organisational security measures allowed a threat actor to exfiltrate personal data… The decision
  14. Monetary penalty: £14,000,000 · UK Information Commissioner’s Office · Capita plc and Capita Pension Solutions Ltd
    The Information Commissioner’s Office has fined Capita plc and Capita Pension Solutions Ltd a combined £14m following a cyber attack in April 2023 which saw hackers gain access to over 6m people’s data. The decision
  15. Reprimand · UK Information Commissioner’s Office · South Yorkshire Police
    A reprimand has been issued to South Yorkshire Police for failing to ensure it had appropriate technical security and organisation measures in place which led to the accidental deletion of 96,174 pieces of original Body Worn Video footage. The redaction in the reprimand was actioned by the ICO The decision
  16. Reprimand · UK Information Commissioner’s Office · London Borough of Hammersmith and Fulham
    We issued a reprimand to the London Borough of Hammersmith and Fulham after hidden data within a spreadsheet was inadvertently disclosed in response to a Freedom of Information Act request. The decision
  17. Monetary penalty: £3,070,000 · UK Information Commissioner’s Office · Advanced Computer Software Group Limited
    The Information Commissioner’s Office (ICO) has fined Advanced Computer Software Group Ltd (Advanced) £3.07m for security failings that put the personal information of 79,404 people at risk. The decision
  18. Reprimand · UK Information Commissioner’s Office · London Borough of Hackney
    The Information Commissioner’s Office has issued the London Borough of Hackey with a reprimand following a cyber-attack in 2020 that led to hackers gaining access to and encrypting 440,000 files, affecting at least 280,000 residents and other individuals including staff. The decision
  19. Reprimand · UK Information Commissioner’s Office · The Electoral Commission
    Reprimand issued to the Electoral Commission in respect of Articles 5(1)(f) and 32(1)(b). Between 24 August 2021 and 27 October 2022, a threat actor had access to the Electoral Commission’s systems and was able to access personal data held as part of the Electoral Register. This incident impacted approximately… The decision
  20. Enforcement notice · UK Information Commissioner’s Office · Home Office
    An enforcement notice and a warning have been issued to the Home Office for failing to assess the privacy risks posed by the electronic monitoring of people arriving in the UK by unauthorised means. The ICO has been in discussion with the Home Office regarding its pilot to place ankle tags on, and track the GPS… The decision
  21. Reprimand · UK Information Commissioner’s Office · Birmingham Children's Trust Community Interest Company
    Reprimand issued to Birmingham Children’s Trust Community Interest company in respect of Article 5(1)(f) and 32(1)(b) and 2. A child protection plan containing inappropriate personal data, in the form of criminal allegations against a child, was sent to the family the plan was produced for. Although the care plan… The decision
  22. Reprimand · UK Information Commissioner’s Office · Mayor’s Office for Policing and Crime (MOPAC)
    Within the London.gov.uk website, there was a webform to contact the London Victims’ Commissioner as well as other webforms. Between 11-14 November 2022, a member of GLA intended to give four members of MOPAC permission to the webforms. However, instead of granting permission to the four members of MOPAC, they made… The decision
  23. Reprimand · UK Information Commissioner’s Office · Chief Constable West Midlands Police
    A reprimand has been issued to West Midlands Police after the force repeatedly incorrectly linked and merged the records of two individuals with similar personal data. West Midlands Police failed to ensure the accuracy of the personal data of these two individuals, resulting in multiple incidents where officers… The decision
  24. Monetary penalty: £350,000 · UK Information Commissioner’s Office · Ministry of Defence
    The MOD sent emails inadvertently using the “To” field rather than the “BCC” field. 265 unique email addresses were disclosed in breach of GDPR Article 5(1)(f). The MOD were fined £350,000. The decision
  25. Reprimand · UK Information Commissioner’s Office · Charnwood Borough Council
    Reprimand issued for the disclosure of the new address of the data subject to an ex-partner who was the alleged perpetrator of domestic abuse against the data subject. This caused significant distress to the data subject and has the potential to result in actual harm. In addition, the investigation highlighted that… The decision
  26. Reprimand · UK Information Commissioner’s Office · GRS (Roadstone) Limited
    The Information Commissioner (the Commissioner) issues a reprimand to GRS (Roadstone) Limited in respect of infringements of Article 32 (1) (b) and Article 32 (1) (d) of the UK GDPR. The organisation did not have appropriate security measures in place, which resulted in an unauthorised Threat Actor being able to… The decision
  27. Reprimand · UK Information Commissioner’s Office · Police Service of Northern Ireland (PSNI)
    PSNI failed to have appropriate measures in place to prevent unlawful sharing of personal data including criminal data with the United States Department of Homeland Security (DHS). The decision
  28. Reprimand · UK Information Commissioner’s Office · Gap Personnel Holdings Limited
    The Information Commissioner (the Commissioner) issues a reprimand to Gap Personnel Holdings Limited in respect of infringements of Article 32 (1), Article 32 (1) (b) and Article 32 (1) (d) of the UK GDPR. The organisation did not have appropriate security measures in place, which resulted in an unauthorised threat… The decision
  29. Reprimand · UK Information Commissioner’s Office · Optionis Group Limited
    The data controller suffered a ransomware attack, which resulted in the exfiltration of personal data. A reprimand was issued in respect of specific infringements of the UK GDPR, which include lack of multi-factor authentication, an inadequate account lockout policy, and no clear Bring Your Own Device policy. The decision
  30. Reprimand · UK Information Commissioner’s Office · Chief Constable West Mercia Police and Chief Constable Warwickshire Police
    On 21 June 2021 West Mercia Police and Warwickshire Police erroneously decommissioned a server containing a Warwickshire Police application. This application contained Warwickshire Police data from between November 2001 and early 2014. The data which has been lost on this application is unrecoverable. The decision
  31. Reprimand · UK Information Commissioner’s Office · Nottinghamshire County Council
    A social worker sent copies of a Child and Family Assessment report to the mother and her two ex-partners: each the father of one of her two children. The report contained sensitive personal data which should have been redacted from the copies sent to the partners. The material disclosed related to previous domestic… The decision
  32. Reprimand · UK Information Commissioner’s Office · Swinburne, Snowball and Jackson
    The Information Commissioner (the Commissioner) issues a reprimand to Swinburne, Snowball and Jackson in respect of infringements of Article 5(1)(f), which requires personal data is processed securely, and Article 32(1)(b) of the UK GDPR, which requires appropriate measures are in place to ensure a level of security… The decision
  33. Reprimand · UK Information Commissioner’s Office · NHS Lanarkshire
    The Information Commissioner (the Commissioner) issues a reprimand to NHS Lanarkshire in accordance with Article 58 (2)(b) of the UK General Data Protection Regulation (UK GDPR) for the sharing of personal data of patients via unauthorised means and secondly, a disclosure of personal data. The decision
  34. Reprimand · UK Information Commissioner’s Office · My Media World Limited t/a Brand New Tube
    Reprimand has been issued to the above organisation in respect of Article 32 (1) and Article 32 (1) (d) of the GDPR. My Media World Limited failed to implement appropriate technical security and organisational measures to properly secure their systems, resulting in unauthorised access to their systems and the… The decision
  35. Reprimand · UK Information Commissioner’s Office · The Patient and Client Council
    A reprimand has been issued to The Patient and Client Council in relation to infringements of Article 5 (1)(f) and Article 32 (1) of the UK GDPR. The infringements were identified following an investigation into the disclosure of special category due to an email sent to 15 individuals using carbon copy (CC) rather… The decision
  36. Reprimand · UK Information Commissioner’s Office · Nottinghamshire Police
    The breach in this case was an unauthorised disclosure of the personal data of witnesses via a police officer’s unredacted statement on the CPS Digital Case Management system. The evidence has revealed that in this instance, the cause of the disclosure of the personal data of witnesses was the failure to ensure the… The decision
  37. Monetary penalty: £12,700,000 · UK Information Commissioner’s Office · TikTok Information Technologies UK Limited and TikTok Inc (TikTok)
    The Information Commissioner’s Office (ICO) has issued a £12,700,000 fine to TikTok Information Technologies UK Limited and TikTok Inc (TikTok) for a number of breaches of data protection law, including failing to use children’s personal data lawfully. The decision
  38. Reprimand · UK Information Commissioner’s Office · Achieving for Children
    Due to communication failure and a lack organisational measures, AfC inappropriately disclosed personal data, special category data and criminal conviction data in a report. The decision
  39. Reprimand · UK Information Commissioner’s Office · Gain Capital UK Limited
    Gain Capital UK have been issued a Reprimand in respect of Articles 32 (2) and 32 (1) (b). An unauthorised third party leveraged an unpatched software vulnerability to access Gain Capital’s systems and exfiltrate personal data relating to 72,361 UK Data Subjects. Gain Capital had a support contract in place with a… The decision
  40. Reprimand · UK Information Commissioner’s Office · University Hospitals Bristol and Weston NHS Foundation Trust
    Patient records were saved on to an Electronic Document Viewing System. The Trust decided to terminate the use of this system and the records on it were downloaded prior to allowing the system licence to expire. However this download was not fully successful but this was not investigated prior to the licence expiry… The decision
  41. Reprimand · UK Information Commissioner’s Office · Chartered Institute for Securities & Investment
    An unauthorised third party exploited a known vulnerability in the Sitefinity software to leverage a bruteforce attack to upload a malicious code to the Chartered Institute for Securities & Investment (CISI)’s website checkout page. The code captured payment details of an estimated 3,883 UK Data Subjects, as well… The decision
  42. Reprimand · UK Information Commissioner’s Office · Power Leisure Bookmakers Limited
    The ICO has issued PLB with a reprimand, in accordance with Article 58 of the UK GDPR, following breaches reported to the ICO on 27 August 2021, 3 September 2021, 9 June 2022, and 7 July 2022. The decision
  43. Reprimand · UK Information Commissioner’s Office · Department for Work and Pensions
    A reprimand has been issued after the inappropriate disclosure of individuals personal data by Child Maintenance Appeals (CM Appeals) within the Department for Work and Pensions (DWP). DWP implemented the Xerox Reprographics application into CM Appeals to handle and redact CM Appeals bundles. No testing or data… The decision
  44. Reprimand · UK Information Commissioner’s Office · London Borough of Hackney
    For the period of April 2020 to February 2021, London Borough of Hackney did not respond to over 60% of the SARs submitted to them in the statutory timeframe. The oldest SAR was over 23 months. The decision
  45. Reprimand · UK Information Commissioner’s Office · Ministry of Justice
    A reprimand has been issued after an unauthorised disclosure of personal information. A bulk amendment facility was used by staff to effect the required adjournment of a significant number of Magistrates’ Courts’ cases. Although the bulk adjournments were primarily made during April and May 2020, it was not until… The decision
  46. Reprimand · UK Information Commissioner’s Office · South Wales Police
    A reprimand has been issued after the disclosure of personal information by South Wales Police on two separate occasions, the first reported was for an incident in April 2020 (the first incident), and a second is an incident that actually predates the first, that occurred in February 2020 (the second incident). The decision
  47. Reprimand · UK Information Commissioner’s Office · Jackson Quinn
    Jackson Quinn was representing two children in relation to step-parent adoption proceedings at the family court. The case was listed for a final hearing to take place on 13 February 2021. Two reports containing personal data which were prepared for the court by social workers from were disclosed to the birth father… The decision
  48. Reprimand · UK Information Commissioner’s Office · Direct Clothing Co. (UK) Limited
    On 19 August 2021, Direct Clothing Co. (UK) Limited (DCCUK) were contacted by a customer who advised that their payment card had been defrauded after using DCCUK’s website. An investigation by DCCUK found that a malicious code had been introduced to the website which allowed an unknown third party to obtain the… The decision
  49. Reprimand · UK Information Commissioner’s Office · Bolton at Home
    Bolton at Home has been issued with a reprimand for the inappropriate disclosure of personal data. The decision

How this list is made

From the UK Information Commissioner’s Office’s published enforcement actions (fines, reprimands and enforcement notices), read every day. An action is listed here when the regulator’s own summary describes a breach or a security failure: a cyber-attack, data exposed or sent to the wrong person, records accessed without a reason. Fines for marketing calls and spam are left out. Each summary is quoted as the regulator wrote it, with a link to its decision. Prosecutions of individuals are left out: they name private people. More regulators, starting with Denmark’s Datatilsynet, are to come.

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Found a mistake? Tell us and we correct it.