Following an initial finding that Advanced Computing Software Group Ltd failed to implement measures to protect the personal information of 82,946 people, the UK’s data privacy regulator has provisionally decided to fine the firm £6.09 million.

Advanced provides IT and software services to organisations on a national scale, including the NHS and other healthcare providers. It also handles people’s personal information on behalf of these organisations as their data processor.

The Information Commissioner’s Office’s (ICO) tentative decision to issue a fine concerns a ransomware incident that took place in August 2022. The ICO provisionally found that hackers initially accessed a number of Advanced’s health and care systems via a customer account that did not have multi-factor authentication.

The ICO has also tentatively found that personal information belonging to 82,946 people was exfiltrated following the attack. The cyber-attack was widely reported at the time of the incident, with reports of disruption to critical services such as NHS 111, and other healthcare staff unable to access patient records.

The data exfiltrated included medical records and phone numbers, as well as details of how to gain entry to the homes of 890 people who were receiving care at home. People impacted have been notified, and Advanced found no evidence that any data was published on the dark web.

The ICO has reiterated that its findings are provisional. Further, that no conclusion should be drawn at this stage that there has, in fact, been any breach of data protection law or that a financial penalty will ultimately be imposed.

The commissioner is to carefully consider any representations Advanced make before a final decision is made, with the fine amount also subject to change.

“This incident shows just how important it is to prioritise information security,” said John Edwards, UK information commissioner. “Losing control of sensitive personal information will have been distressing for people who had no choice but to put their trust in health and care organisations.

“Not only was personal information compromised, but we have also seen reports that this incident caused disruption to some health services, disrupting their ability to deliver patient care. A sector already under pressure was put under further strain due to this incident.

“For an organisation trusted to handle a significant volume of sensitive and special category data, we have provisionally found serious failings in its approach to information security prior to this incident. Despite already installing measures on its corporate systems, our provisional finding is that Advanced failed to keep its healthcare systems secure.

Recommended reading

• NHS Dumfries and Galloway Hit by Cyber-attack
• NHS London Data Breach: 400GB Leaked
• Ransomware Crisis Escalating Globally, New Report Shows

“We expect all organisations to take fundamental steps to secure their systems, such as regularly checking for vulnerabilities, implementing multi-factor authentication and keeping systems up to date with the latest security patches.

“I am choosing to publicise this provisional decision today as it is my duty to ensure other organisations have information that can help them to secure their systems and avoid similar incidents in the future.

“I urge all organisations, especially those handling sensitive health data, to urgently secure external connections with multi-factor authentication.”