grc-scanSecurity & governance
← Back to homethe latest roundup →
ICO watch · UK30 September 2026Archived edition

ICO fines & breach roundup

This edition was published on 30 September 2026 and is kept here unchanged as a record. The threats and cases it describes may have moved on — read the latest roundup for the current picture.

The takeaway

Neither case involved anyone breaking into the company that carries the blame: one leaked out of a supplier's log file, the other came from design decisions made years before the penalty landed.

  • Email every payment and data supplier one question: what do your logs record, and for how long?
  • Check nothing in your checkout keeps a card's CVV after payment — storing it breaks PCI DSS on its own.
  • Find out today whether your supplier contracts get you breach news inside 72 hours, because you send the letter.

ICO fines & breach roundup — 30 September 2026

A plain-English look at recent UK Information Commissioner's Office (ICO) enforcement and notable data-protection news — who was penalised, why, and what a small business should learn from it. The pattern is consistent and the lessons are cheap to act on.

The ICO's enforcement register has still published no new fine, reprimand or enforcement notice since late August — the second quiet fortnight running — so this is a shorter edition of two cases rather than a padded one. What the week did produce is a supplier breach that exposed full card numbers including the three digits on the back, and the end of the regulator's longest-running children's-privacy fight. On the ICO's change of name, previewed here last week: it took effect today, 30 September, the regulator says it will still be known as the ICO, and there is nothing for you to do.

1. A jewellery supplier's customers had their full card numbers and CVVs exposed — and the company's own systems were never touched

On 24 September Cooksongold, a long-established UK supplier of jewellery-making materials, published a data breach notice about an incident at one of its suppliers. The technical shape of this one is worth reading slowly, because it is the version of a breach that a careful small business is least prepared for. When a customer paid by card, the checkout sent them through a 3DS check — the "confirm this payment in your banking app" step that is meant to reduce fraud — and that check is handled by a third party. That third party kept a log. The log was supposed to have the card details redacted. One log did not: "We have had clarification from our third-party provider that it was not aware of the log containing this information. In normal circumstances this data is redacted; however, a log containing an unredacted record was identified." That provider then suffered "unauthorised access to its systems." The data in the log was the full payment card number, the expiry date, the CVV security code, the billing name, email address, order number and transaction value — which is to say everything needed to use the card online, in one place. The affected payment window runs from 1 November 2025 to 12 September 2026, more than ten months. Cooksongold identified which customers were affected on 23 September and emailed them on 25 September, notified the ICO (case reference IC-571010-M9S9), and says the logs no longer hold unredacted data and the 3DS third party is no longer logging it. Its advice to customers is blunt and correct: "contact your bank or card issuer immediately… Ask them to block the card, issue a replacement and review your account for suspicious payments." Be clear about what is not established: the provider is not named, no number of affected customers has been published, the notice does not pin down when the unauthorised access itself occurred, and Cooksongold says it cannot confirm whether the details "have been used, or guarantee that they will not be." There is no ICO finding or penalty here — only a breach report the regulator now holds. One thing is firmly established and not a matter of opinion, though: the CVV must not be stored at all once a payment has been authorised. That is PCI DSS, the card industry's own mandatory standard, and it is why a log holding CVVs ten months deep is a failure independent of who later broke into it. Cooksongold states its own systems "were not affected or accessed" — and that is precisely the point.

What your business should learn: You can do everything right and still send the breach notification. Cooksongold's own security held; the damage came from a log file inside a supplier it had every reason to trust, doing a job that exists to make payments safer. Three cheap actions. Ask your payment provider, in writing, one question: what do your logs record, and for how long? It is an email, it costs nothing, and the answer is the entire story of this case — note that even the provider here "was not aware" what its own log contained, so ask specifically about card number, expiry and CVV rather than accepting "we're PCI compliant" as an answer. Second, know who notifies your customers. Under the UK GDPR you are the controller of your customers' data even when a processor causes the breach: the letter goes out over your name, so check today whether your contract obliges the supplier to tell you fast enough for you to meet the 72-hour ICO deadline, and what it says about bearing the cost. Third, if you take card payments, do the one-line check: ask whoever built your checkout to confirm nothing in your own stack — logs, error reports, analytics, order confirmations, a spreadsheet someone exports — retains a CVV after the payment goes through. If it does, that alone breaches PCI DSS regardless of whether anyone ever attacks you, and it is usually a setting rather than a rebuild.

2. TikTok gives up: the £12.7m children's-privacy fine is now final, and the investigation it was blocking can restart

On 24 September the ICO announced that TikTok has withdrawn two appeals and agreed to pay the £12.7 million fine first issued in 2023 to TikTok Information Technologies UK Limited and TikTok Inc. (Note the figure carefully — the ICO's own web address for this announcement renders it as "127m", which is the decimal point being stripped out of a URL, not a ten-fold penalty.) The original case: the ICO estimated, on economic analysis, that up to 1.75 million UK children under 13 were using TikTok in 2020, despite the platform's own rules forbidding it; that TikTok failed to carry out adequate checks to find and remove them; that it did not give users clear information about how their data was collected, used and shared, so they "were unlikely to be able to make informed decisions"; and that it failed to obtain parental consent when it ought to have known under-13s were on the platform. The reason the appeal collapsed now is a legal precedent set in August, when the Upper Tribunal dismissed TikTok's argument that its processing had been for artistic purposes — one of the "special purposes" — which, had it succeeded, would have meant the ICO needed prior court approval before issuing the penalty at all. The second withdrawal matters at least as much as the money: TikTok has dropped its challenge to an information notice, a legal demand for documents about how it processes the personal data of 13-to-17-year-olds in its recommender systems. That appeal had stalled an ICO investigation opened in February 2025, which can now proceed. Emily Keaney, ICO Deputy Commissioner, said: "How companies design online services and use children's personal information has a significant impact on young people's experience in the digital world," adding that the regulator had "always been clear that this processing was not for the special purposes." The ICO estimates its work on children's data has helped protect close to five million child users.

What your business should learn: The headline number is irrelevant to a business your size; two mechanics underneath it are not. First, an appeal is not a shield, it is a delay with interest — TikTok contested this for roughly three years, lost on a procedural argument about the nature of its processing, and is paying the original sum anyway, having funded lawyers throughout. If you ever receive a reprimand or penalty notice, the calculation is whether you have a genuine point of law, not whether you can postpone. Second, and far more likely to touch you: an information notice is a legal order, not a request. The ICO can compel you to hand over documents and, since the Data (Use and Access) Act changes took effect in February, can also compel people to attend interviews. Refusing or stalling is its own breach, separate from whatever is being investigated. The practical preparation is unglamorous and free: know today where your records of processing, your privacy notice history and your breach log actually live, so that a request with a statutory deadline is an afternoon of retrieval rather than a crisis. And if you run any service a child might plausibly use, note what actually sank TikTok — not an intrusion, but design decisions about age checks, transparency and consent, made years before the bill arrived.

Sources

Reading about a breach — could it happen to you?

Most of these stories start with something an attacker can see from the outside: an exposed service, a spoofable domain, weak encryption. You can check your own domain for the same things in about a minute — free, no login, nothing intrusive.

Run a free posture scan →Check your Cyber Essentials readiness

Compiled from public ICO enforcement notices and UK data-protection news. For awareness only — not legal advice, and not affiliated with the ICO. Always check the ICO's own published notices for the authoritative detail.