Monetary penalties · General business
Advanced Computer Software Group Limited
What happened
The Information Commissioner’s Office (ICO) has fined Advanced Computer Software Group Ltd (Advanced) £3.07m for security failings that put the personal information of 79,404 people at risk.
Advanced provides IT and software services to organisations, including the NHS and other healthcare providers, and processes people’s personal information on behalf of these organisations.
The fine relates to a ransomware incident in August 2022. Hackers accessed certain systems of Advanced’s health and care subsidiary via a customer account that did not have multi-factor authentication (MFA). The cyber attack was widely reported at the time, with reports of disruption to critical services such as NHS 111, and other healthcare staff unable to access patient records.
Summarised from the notice published by the ICO on 26 March 2025. Read the original notice — it is the authoritative version.
The other end of this
Ransomware crews get in somehow. These are vulnerabilities CISA has tied directly to ransomware campaigns — each one is a live route into an organisation like this one.
- CVE-2026-12569 PTC Windchill and FlexPLM Improper Input Validation Vulnerability PTC · Windchill and FlexPLM
- CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Oracle · PeopleSoft Enterprise PeopleTools
- CVE-2026-50751 Check Point Security Gateway Improper Authentication Vulnerability Check Point · Security Gateway
- CVE-2026-0257 Palo Alto Networks PAN-OS Authentication Bypass Vulnerability Palo Alto Networks · PAN-OS
- CVE-2026-48027 Nx Console Embedded Malicious Code Vulnerability Nx · Nx Console