grc-scanSecurity & governance
← Back to homethe latest roundup →
ICO watch · UK21 October 2026Archived edition

ICO fines & breach roundup

This edition was published on 21 October 2026 and is kept here unchanged as a record. The threats and cases it describes may have moved on — read the latest roundup for the current picture.

The takeaway

Both reprimands this week were about accounts and tools nobody was keeping track of — a password set in 2012, a platform nobody had approved — rather than anything clever an attacker did.

  • Delete dormant accounts — test logins, ex-staff, installer setups — and block common passwords on what is left.
  • Keep a written list of every tool and outside provider that touches customer data, and name one person who approves new ones.
  • If someone else manages your IT, put the data-protection terms in the contract — you stay responsible either way.

ICO fines & breach roundup — 21 October 2026

A plain-English look at recent UK Information Commissioner's Office (ICO) enforcement and notable data-protection news — who was penalised, why, and what a small business should learn from it. The pattern is consistent and the lessons are cheap to act on.

The enforcement register moved this week after three quiet weeks: two reprimands over a forgotten test account, and a reprimand plus enforcement notice against the Metropolitan Police over a tool nobody had approved. No fines, but both decisions turn on the same thing — knowing what accounts and what software are actually in use. Two cases, because that is what the window held; we would rather publish two than pad.

1. "Password1" on a test account nobody had used since 2012 — two reprimands, 3,300 people exposed, most of them children

On 20 October the ICO reprimanded two Welsh organisations over a ransomware attack on 1 November 2024 that exposed personal data about 3,300 people, the majority of them children, from two projects supporting children and families. The way in was a test account, 'Test2', created by IT provider Ogi Networks Limited in January 2012 and protected by the password 'Password1' — a strength checker rated it crackable in under a second. The account had no operational purpose and survived more than 12 years; local administrator accounts on three systems had kept the same password for as long. Attackers took 42GB and encrypted 182.7GB. The ICO found Ogi Networks breached Articles 32(1)(b) and (d) of the UK GDPR — weak password, no strength rules, no audit of the accounts it created. Data Cymru, the controller, breached those plus Article 28(4): no contract with its sub-processor containing the required data-protection terms, and account reviews that were neither scheduled nor complete.

What your business should learn: Two cheap jobs. First, list every account on your systems and delete the ones nobody uses — test logins, former staff, the setup account your installer created years ago. One dormant account is the whole breach here. Block common passwords on what remains, turn on MFA for anything reachable from the internet, and give privileged accounts unique credentials rather than a shared one. Second, if an outside IT provider manages your accounts, get the data-protection terms in writing and agree who reviews what, how often. Data Cymru was reprimanded partly for not having that contract: the regulator treated "our IT company set it up" as the controller's own failure, not an excuse. Ask your provider this week for a list of every account they have created for you.

2. The Met used a crime-intelligence platform nobody had approved — reprimand and enforcement notice

On 14 October the ICO published a reprimand and enforcement notice against the Metropolitan Police Service, issued on 23 September. Officers and staff had used an unapproved third-party retail crime intelligence platform to share information about suspected shoplifters: around 500 accounts created, 375 actively used. Between January and September 2024, personal information about 179 people was uploaded — three of them under 18 — including names, dates of birth and, in a small number of cases, home addresses. The force had not followed its own assessment and approval process for third-party technology, had not completed a data protection impact assessment before high-risk processing, and the ICO found the sharing was not necessary for law enforcement purposes. The MPS suspended the platform in September 2024 and reintroduced it in January 2026 with governance, training, contracts and a DPIA in place — but the ICO still acted, finding the force continues to fail to ensure only approved technology processes personal data.

What your business should learn: This is shadow IT, and a small business usually has more of it than a police force: the free trial someone signed up for, the WhatsApp group where staff discuss customers, the spreadsheet in a personal cloud account. The ICO's line: "organisations cannot allow innovation to outpace their data protection responsibilities." Two cheap actions. Write down every tool that touches customer data, and ask your team what they actually use rather than what you think they use; the gap is the finding. Then set one rule: nothing new that holds customer information gets used until a named person has agreed it. Note what did not spare the Met — it had fixed the tool before the decision. The governance gap was the finding.

Sources

Reading about a breach — could it happen to you?

Most of these stories start with something an attacker can see from the outside: an exposed service, a spoofable domain, weak encryption. You can check your own domain for the same things in about a minute — free, no login, nothing intrusive.

Run a free posture scan →Check your Cyber Essentials readiness

Compiled from public ICO enforcement notices and UK data-protection news. For awareness only — not legal advice, and not affiliated with the ICO. Always check the ICO's own published notices for the authoritative detail.