Root cause
Cyber attack
An external attacker got in and took data. Where the ICO's notice names the specific failure that let them, the case is filed under that instead.
12
UK enforcement actions
£18.50m
in penalties
8
sectors affected
Where it happens
- Unspecified2
- General business2
- Local government2
- Legal2
- Utilities1
- Online technology and telecoms1
- Education and childcare1
- Media1
Every case
- South Staffordshire Plc and South Staffordshire Water Plc The Information Commissioner’s Office (ICO) has imposed a fine of £963,900 on South Staffordshire Plc & South Staffordshire Water …
- LastPass UK Ltd £1,228,283 penalty issued to password management provider LastPass UK Ltd on 20 November 2025 in respect of infringements of Artic…
- Capita plc and Capita Pension Solutions Ltd The Information Commissioner’s Office has fined Capita plc and Capita Pension Solutions Ltd a combined £14m following a cyber atta…
- 23andMe The Information Commissioner has fined 23andMe, Inc £2,310,000 for infringements of Articles 5(1)(f) and 32(1) of the UK GDPR betw…
- London Borough of Hackney The Information Commissioner’s Office has issued the London Borough of Hackey with a reprimand following a cyber-attack in 2020 th…
- Levales Solicitors LLP Reprimand issued to Levales Solicitors LLP (‘Levales’) in respect of Articles 32(1)(b) and 32(1)(d). A threat actor accessed Leval…
- Birmingham Children's Trust Community Interest Company Reprimand issued to Birmingham Children’s Trust Community Interest company in respect of Article 5(1)(f) and 32(1)(b) and 2. A chi…
- Finham Park Multi Academy Trust Finham Park Multi Academy Trust have been issued a Reprimand in respect of Articles 5 (1) (f) and 32 (1) (b). An unauthorised thir…
- Gap Personnel Holdings Limited The Information Commissioner (the Commissioner) issues a reprimand to Gap Personnel Holdings Limited in respect of infringements o…
- Gloucester City Council The Information Commissioner (the Commissioner) issues a reprimand to Gloucester City Council in respect of infringements of Artic…
- Swinburne, Snowball and Jackson The Information Commissioner (the Commissioner) issues a reprimand to Swinburne, Snowball and Jackson in respect of infringements …
- My Media World Limited t/a Brand New Tube Reprimand has been issued to the above organisation in respect of Article 32 (1) and Article 32 (1) (d) of the GDPR. My Media Worl…