grc-scanSecurity & governance
← Back to homethe latest roundup →
ICO watch · UK12 August 2026Archived edition

ICO fines & breach roundup

This edition was published on 12 August 2026 and is kept here unchanged as a record. The threats and cases it describes may have moved on — read the latest roundup for the current picture.

The takeaway

This fortnight's breaches all trace back to someone else holding data on a business's behalf — a CRM supplier, an internal file-sharing slip, a shipping partner — rather than to the organisation whose customers were ultimately exposed.

  • Ask any supplier who touches your customer data what MFA and access-key controls protect their systems, in writing.
  • Set shared drives and files to private by default, and require a second person's check before anything is published.
  • Ask fulfilment, logistics and other processors how long they keep your customers' data after the job is done — shorter is safer.

ICO fines & breach roundup — 12 August 2026

A plain-English look at recent UK Information Commissioner's Office (ICO) enforcement and notable data-protection news — who was penalised, why, and what a small business should learn from it. The pattern is consistent and the lessons are cheap to act on.

1. Beacon CRM breach exposes supporter and donor data across more than 1,000 UK charities after compromised credentials

Beacon, a customer-relationship-management platform used by well over a thousand UK charities and non-profits, detected unauthorised access to its systems around 29 July 2026 and began notifying customers on 3 August. Investigators, supported by external cyber-security specialists, found that an unauthorised third party had used compromised login credentials to access Beacon's systems and download copies of database backups. The data potentially exposed includes supporters' and donors' names, postal and email addresses, phone numbers, donation histories and Gift Aid status — Beacon has told customers to assume the data was both copied and readable, since it warned the backups may have been decryptable. Affected organisations confirmed so far include the Molly Rose Foundation, Victim Support, the Scottish Council for Voluntary Organisations and several hospital and health-related charities. No payment card or password data appears to have been involved. The incident has not (as of this roundup) resulted in a published ICO enforcement outcome — it is included here as a live, unfolding example of a category of breach the ICO consistently penalises once investigated: preventable credential compromise at a supplier holding other organisations' data.

What your business should learn: Any organisation that hands customer, donor or client data to a CRM, booking system or other SaaS supplier is exposed to that supplier's security, not just its own. Before signing up (and periodically afterwards), ask two plain questions in writing: does the supplier enforce multi-factor authentication on every account and API/access key that can reach your data, and how often are those keys rotated or reviewed? If a supplier can't answer clearly, that's the answer.

2. UK Government Investments disclosed a 40-hour exposure of officials' contact details after a staff member bypassed information-security policy

UK Government Investments (UKGI), the body that manages the government's shareholdings in organisations such as NatWest and the Post Office, disclosed in early August 2026 that an internal file containing high-level management information, plus the names and work email addresses of 51 government officials, had been left publicly accessible for around 40 hours during the 2025-26 financial year. UKGI said the exposure happened because a member of staff did not follow the organisation's established information-security policies when handling the file. Although the incident did not meet the threshold for mandatory notification, UKGI escalated it to its board and voluntarily reported it to the ICO, then commissioned external cyber-security specialists to review its arrangements. Most of the review's recommendations for stronger internal controls have reportedly already been implemented, with the remainder due over coming months.

What your business should learn: Most accidental-exposure breaches start the same way this one did — a file or folder gets shared or published with a default setting nobody checked. Set shared drives (Google Drive, SharePoint, OneDrive) to private-by-default rather than "anyone with the link," and require a second person to confirm the audience before anything containing personal or sensitive information is published or emailed out. UKGI's decision to self-report even when it didn't have to is also worth copying: a voluntary, prompt disclosure is treated far more favourably by the ICO than a cover-up that surfaces later.

3. CEVA Logistics supply-chain breach ripples into UK and European retailers, including Valve's Steam hardware customers

Between around 29 July and 1 August 2026, global logistics firm CEVA Logistics suffered a cyber intrusion affecting part of its European contract-logistics operations; the company confirmed the incident to affected customers on 1 August. Attackers gained access to backend order-fulfilment databases covering roughly a 90-day window of shipping records, exposing customers' full names, delivery addresses, phone numbers, email addresses and itemised order details (including, for some retailers, exact purchase prices). Because CEVA fulfils orders on behalf of many other companies, the breach's impact rippled outward to those companies' own customers — Valve notified European and UK buyers of its Steam hardware, and reports name ING Bank, Levi Strauss, and several other European retailers among those affected. None of these companies were breached directly; their customers' data was exposed via a shared logistics partner. Passwords, payment details and account credentials were not affected. How the attackers first got into CEVA's systems has not been publicly disclosed.

What your business should learn: If you use a courier, fulfilment house or logistics partner to ship physical goods, their systems typically hold a live copy of your customers' names, addresses and order details for some period after delivery — a fact that's easy to forget once a parcel has arrived. Ask your fulfilment and shipping partners how long they retain that data after a job is complete and whether it's encrypted at rest; shorter retention windows mean less of your customers' data is sitting in someone else's breach waiting to happen.

Sources

Reading about a breach — could it happen to you?

Most of these stories start with something an attacker can see from the outside: an exposed service, a spoofable domain, weak encryption. You can check your own domain for the same things in about a minute — free, no login, nothing intrusive.

Run a free posture scan →Check your Cyber Essentials readiness

Compiled from public ICO enforcement notices and UK data-protection news. For awareness only — not legal advice, and not affiliated with the ICO. Always check the ICO's own published notices for the authoritative detail.