grc-scanSecurity & governance
← Back to homethe latest roundup →
ICO watch · UK2 September 2026Archived edition

ICO fines & breach roundup

This edition was published on 2 September 2026 and is kept here unchanged as a record. The threats and cases it describes may have moved on — read the latest roundup for the current picture.

The takeaway

Both cases turn on something the business could have checked itself, free, in an afternoon — a credential sitting in a public web page, and a call list never screened against the do-not-call register.

  • Open your own site, view the page source, and search it for "key", "token" and "secret".
  • Give every marketing or analytics platform its own narrow key, and change it when a supplier or staff member leaves.
  • Screen every marketing call list against the TPS, and keep the dated proof for each campaign.

ICO fines & breach roundup — 2 September 2026

A plain-English look at recent UK Information Commissioner's Office (ICO) enforcement and notable data-protection news — who was penalised, why, and what a small business should learn from it. The pattern is consistent and the lessons are cheap to act on.

1. Manchester Airports Group tells 8.7 million customers their data was taken — reportedly via a key left in a public web page

Manchester Airports Group (MAG), which runs Manchester, London Stansted and East Midlands airports, confirmed on 27 August 2026 that an unauthorised third party had accessed data belonging to around 8.7 million customers, and began emailing them. The affected records relate to car park, lounge and Fast Track bookings and airport Wi-Fi registrations, and include email addresses, phone numbers, postcodes and vehicle registration numbers. MAG says neither it nor the affected system held bank or payment card details, that aviation security and airport operations were unaffected, and that it has notified the ICO, the National Cyber Security Centre and law enforcement. MAG told the BBC a ransom was demanded and that it refused to pay. An extortion group calling itself FulcrumSec has claimed responsibility and says it took around 86GB of data; that claim, and its account of how, are the group's own and have not been confirmed by MAG. What makes the claimed method worth reading is how mundane it is: FulcrumSec says it did not break into anything, but simply found an API credential for Iterable — the third-party marketing and customer-engagement platform holding the data — sitting in the JavaScript that MAG's own website sends to every visitor's browser, and used it to query the platform directly. No ICO outcome has been published; the regulator is at the "assessing what we've been told" stage, which is where every fine in this series started.

What your business should learn: Anything your website sends to a visitor's browser is public, including the code — anyone can press F12, read your page source, and search it. If your site connects to a mailing-list tool, a booking system, a chat widget or an analytics platform, ask whoever built it a direct question: is any key, token or password for those services present in the front-end code? It is a five-minute check and the fix (move the call to your server, or issue the platform a key that can only do the one narrow thing the page needs) costs a developer an hour. Then ask the second question, which is the one this case really turns on: your customer data probably lives in a supplier's platform rather than on your own systems, so who holds the keys to it, how many people have them, and when were they last changed?

2. Elderly Aids Ltd fined £190,000 for making 758,053 nuisance calls — while selling nuisance-call blockers

The ICO fined Elderly Aids Ltd £190,000 in late August 2026 for making 758,053 unsolicited marketing calls between May 2024 and February 2025 to people registered with the Telephone Preference Service (TPS) — the free register that tells companies a number must not be cold-called. The company was selling call-blocking devices marketed at protecting elderly people from exactly this kind of call, charging a reported £139 sign-up fee plus £6.99 a month. Complainants described callers who were aggressive, misleading and often would not say who they were; one said their father was pressured into signing up. Under the Privacy and Electronic Communications Regulations (PECR), a live marketing call to a TPS-registered number is unlawful unless that person has specifically told your company they are happy to be called — and the ICO found none of the 758,053 had. The regulator described a complete disregard for the rules, which is the language it uses when the failure looks deliberate rather than sloppy.

What your business should learn: If you make marketing phone calls to anyone, you must screen your list against the TPS before you dial, and you must be able to show you did — the TPS licence is a modest annual cost and screening is the entire compliance obligation for most small firms. Two practical habits make the difference: keep the dated screening file for every campaign, because "we thought the list was clean" is not a defence when the ICO asks; and if you buy lists or use a call centre, put in writing who is responsible for TPS screening and consent records, because the fine lands on the business whose product is being sold, not on the agency that dialled. The same logic applies to texts and emails, where the rule is consent rather than a register — and note that PECR penalties now reach far higher than the old £500,000 ceiling.

Sources

Reading about a breach — could it happen to you?

Most of these stories start with something an attacker can see from the outside: an exposed service, a spoofable domain, weak encryption. You can check your own domain for the same things in about a minute — free, no login, nothing intrusive.

Run a free posture scan →Check your Cyber Essentials readiness

Compiled from public ICO enforcement notices and UK data-protection news. For awareness only — not legal advice, and not affiliated with the ICO. Always check the ICO's own published notices for the authoritative detail.