grc-scanSecurity & governance
← Back to homethe latest roundup →
ICO watch · UK7 October 2026Archived edition

ICO fines & breach roundup

This edition was published on 7 October 2026 and is kept here unchanged as a record. The threats and cases it describes may have moved on — read the latest roundup for the current picture.

The takeaway

This week's breaches needed no intruder: the data that escaped was hiding in spreadsheet tabs nobody opened, and in the message box customers had typed into themselves.

  • Before sending or publishing a spreadsheet, unhide the tabs and assume any pivot table still carries its source data — share a CSV instead.
  • Treat your contact form and shared inbox as a database: set a deletion schedule, because data you no longer hold cannot leak.
  • Take the free core membership at your regional police-led Cyber Resilience Centre before you need it, not after.

ICO fines & breach roundup — 7 October 2026

A plain-English look at recent UK Information Commissioner's Office (ICO) enforcement and notable data-protection news — who was penalised, why, and what a small business should learn from it. The pattern is consistent and the lessons are cheap to act on.

One correction to open with. Last week's edition said the enforcement register had published nothing new since late August; it had, on 29 September, the day before we went out — two reprimands against Norfolk and Suffolk Constabularies for personal data left hidden inside spreadsheets they published on the open web. They are the best small-business lesson the register has produced in months, and they lead this edition. Alongside them: a London landlord whose breach consisted entirely of the messages its residents had sent it, and the ICO joining the police-led network that gives small businesses cyber help for nothing. We have not written up the ten NHS staff removed from duty at East Suffolk and North Essex for allegedly viewing a dead child's medical records — the ICO is "making enquiries" and it is a serious case, but it is the same lesson as the Southport court-staff case in our 23 September edition, and we would rather say that than write it twice.

1. Two police forces published victims' details on their own websites — the data was in the spreadsheet all along, in a tab nobody opened

On 29 September the ICO published reprimands issued on 20 May 2026 to Norfolk Constabulary and Suffolk Constabulary, each for infringing Article 5(1)(f) UK GDPR — the duty to process personal data securely. Between them the two forces put the personal data of not less than 846 people (Norfolk) and not less than 436 people (Suffolk) "unlawfully" into the public domain. Nobody attacked them. They answered Freedom of Information requests.

The mechanism is the part worth reading slowly, because it is sitting in most businesses' shared drives right now. There were two distinct versions of the same mistake. In the 2018 Suffolk case, an analyst pulled raw crime records into Excel and built a summary sheet beside them. The summary went to the requester as a PDF — correctly — but the spreadsheet itself was later uploaded to the force's own disclosure log, and the raw data was still sitting in a second worksheet reachable from the tab bar. The force's own post-incident review found its reviewer "had conducted a pre-publication check of the Microsoft Excel document but failed to identify the secondary worksheet containing the raw data". Suffolk's explanation to the ICO is the sentence every owner should recognise: "When the Excel sheet was opened, the tabs with the raw data could not be seen… it was not easy to see the extent of the data within the document once it was formatted. When opened, the document appears to only have one tab with the inability to scroll for more tabs." That file was online from no later than 28 February 2019 until 7 November 2022 — almost four years. The fields exposed included investigation number, victim and suspect dates of birth, ages, genders, offence location and type, outcome, and a free-text "modus operandi" field that in some records contained names. Of 74 people Suffolk identified as identifiable, 34 were victims and seven were assessed as being at "high risk to safeguarding". The underlying request had asked for statistics on sexual offences where both the victim and the perpetrator were under 18.

The 2021–2022 cases are worse, because the data was not in a visible tab at all. The forces' joint analytical team had moved to extracting data with Power Pivot, leaving spreadsheets with a live link to a SQL source. As Suffolk told the ICO: "when transmitting the .XLS file externally, Excel automatically created a one-time copy of the data within the file instead. The source data remained hidden (i.e. on this occasion it did not appear within a worksheet)." Thirty-four spreadsheets were involved; some went to requesters, some onto the forces' publication schemes, and some onto WhatDoTheyKnow, where anyone could download them. One held 89 rows of hidden data, another 377 — names, dates of birth, gender, incident summaries and outcomes. The last of the files was not removed until July 2024. A Data Protection Impact Assessment had been done when the forces changed tools and failed to spot that Power Pivot retained the source data.

The ICO's finding is not about the software. It is about training, policies and procedures: staff "were unaware of the importance of these checks", and the regulator notes that "the risks of hidden data are well known", citing its own guidance that "in particular, take care when using pivot tables to anonymise data in a spreadsheet. The spreadsheet will usually still contain the detailed source data, even if this is hidden and not immediately visible at first glance. Consider converting the spreadsheet to a plain text format (such as CSV) if necessary." Because both forces are public authorities, the ICO applied its public sector approach and issued reprimands rather than fines, while publishing what the fine would have been: the Suffolk notice records an indicative penalty of £70,875 that is "not actually being imposed". Read the Norfolk notice carefully — it states the same £70,875 figure but names Suffolk in that sentence, so treat it as one published calculation rather than two separate sums.

What your business should learn: You do not need to be a police force to do this, and the fix costs nothing but a habit. Before you send or publish any spreadsheet, check what is actually in it. Right-click the tab strip at the bottom and choose Unhide — hidden worksheets do not announce themselves, and as Suffolk found, a formatted file can look like it has one tab when it has several. If your file contains a pivot table or a chart, assume the full source data is still inside it even when you cannot see the table; the safe move is the one the ICO itself recommends — export the figures you actually want to share as a CSV, and send that instead of the workbook. Second, the moment you change how you extract data, re-check what the new tool leaves behind. Both forces got caught by a tooling upgrade that was meant to improve efficiency and silently started shipping the source data with every file; their own impact assessment missed it. A five-minute test — generate one file the new way, open it on a different machine, and try to dig the raw data back out — would have caught it. Third, know where your old files went. Suffolk's 2018 file sat on its own website for nearly four years, and these breaches were only sized once somebody went looking across a disclosure log, a publication scheme and a third-party website. If you publish price lists, statistics, tenders or reports, keep a list of what you have uploaded and where, because you cannot take down what you have forgotten about.

2. A landlord's breach was nothing but the messages 12,000 residents had sent it

On 28 September L&Q (London & Quadrant), a housing association with turnover around £1 billion, told residents that an unauthorised party had accessed emails and webform messages sent to it by approximately 12,000 residents. L&Q's position is that the exposure stops there: "the incident is limited to the online contact made by these residents", with no evidence that bank details, the wider resident databases, tenancy and property records, or supplier and partner information were touched. Those affected were emailed directly, and L&Q notified both the ICO and the Regulator of Social Housing. Its website and online resident services were taken down — "our website, including online services for residents, are currently unavailable, and may continue being so for some time" — with residents told to phone or email instead. L&Q warned of "an increased risk of fraud attempts and phishing by email" and said it knew of no malicious use of the information. Be clear what is not established: no attacker or group has been named by L&Q or, as far as we can see, credibly identified by anyone else; there is no ICO finding, no penalty and no public technical account of how the access happened; and the "around 12,000" figure is L&Q's own count at the time of notification. This is a breach report, not a case.

What your business should learn: The thing worth sitting with here is how ordinary the exposed data was. Not a customer database, not card details, not a system of record — the contact form on the website and the inbox behind it. Most small businesses have exactly that, and almost nobody treats it as personal data. It is: a tenant describing a damp problem, a customer explaining why they want a refund, a patient asking about an appointment. Read as a set, those messages are often more sensitive than the database they sit beside, because people write freely in a message box in a way they never do in a form field. Two cheap actions. First, find out how long your contact form and shared inbox keep messages, and set a limit. For most small businesses a web enquiry is useful for weeks, not years; if your form emails into a mailbox that has kept everything since 2019, that is a decade of other people's problems waiting to be read by whoever gets in. Deleting on a schedule is free and it is the single most effective control there is — data you no longer hold cannot leak. Second, when a breach does happen, say what you know and warn people about the realistic next step. L&Q's notice did the useful thing: it told residents the risk was phishing, which is exactly right when what leaked is correspondence. Someone holding your customers' own words to you can write a follow-up email that sounds completely legitimate. Telling customers plainly "we will never ask you to confirm payment details by email" costs one sentence and blunts most of the damage.

3. The ICO joined the police-led network that helps small businesses for free — and it says most incidents come from missing the basics

On 1 October the ICO announced it has joined the National Cyber Resilience Centre Group's National Ambassador Programme. That sounds like regulator housekeeping, and the press release largely is, but the practical content is worth knowing because it points at help that is free and that most owners have never heard of. The NCRCG is a not-for-profit collaboration between policing, government, the private sector and academia, funded via the Home Office and police, running a network of regional Cyber Resilience Centres across the UK. The ICO says the partnership lets it "connect small and medium-sized enterprises (SMEs) with free and affordable support available across the UK". The regional centres generally offer a free core membership — the South West centre, for example, advertises free membership covering cyber-safety guidance, exercises and toolkits, a named point of contact and regular threat updates. Ian Hulme, the ICO's Group Director for Regulatory Assurance and Cyber, made the point that matters more than the partnership: "We see every day that many cyber incidents stem from organisations not getting the basics right. Helping organisations take practical steps to improve their cyber resilience is one of the most effective ways to reduce harm and protect people's information." He also set out the regulator's two-handed posture plainly — supporting organisations "while taking action where poor security practices put people at risk". The ICO adds that it is "urging organisations not to wait for an incident", and that cyber resilience and business support will feature at its Data Protection Practitioners' Conference on 13 October 2026, for which registration is open.

What your business should learn: This is the rare enforcement-adjacent story with a to-do list rather than a warning. Find your regional Cyber Resilience Centre and take the free membership. It is police-led and not-for-profit, so nobody is selling you a retainer, and the practical value for a business with no IT department is the two things you cannot easily buy: threat updates written for your size of organisation, and a human to ask. Do it this week rather than at the point you need it — a named contact is worth most on the day something is going wrong. Second, take the quote at face value and audit yourself against the basics rather than the headlines. The regulator's own observation, from the organisations it investigates, is that most incidents come from the basics being missed — not from novel attacks. The reprimands in entry 1 of this edition are precisely that: no intrusion, no sophistication, just training and procedure that had not kept up with the tooling. If you want the shortest honest version of "the basics": multi-factor authentication on email and anything administrative, supported software that still gets updates, backups you have actually restored from once, and a known limit on how long you keep personal data. Third, if you employ someone with data protection in their remit, the 13 October conference is a legitimate use of a day — and if you do not, the ICO's own SME guidance is free and written for businesses without a security team, which is a much better starting point than a search engine.

Sources

Reading about a breach — could it happen to you?

Most of these stories start with something an attacker can see from the outside: an exposed service, a spoofable domain, weak encryption. You can check your own domain for the same things in about a minute — free, no login, nothing intrusive.

Run a free posture scan →Check your Cyber Essentials readiness

Compiled from public ICO enforcement notices and UK data-protection news. For awareness only — not legal advice, and not affiliated with the ICO. Always check the ICO's own published notices for the authoritative detail.