Reprimands · Legal
Levales Solicitors LLP
No fineReprimands
Root cause
Cyber attack
An external attacker got in and took data. Where the ICO's notice names the specific failure that let them, the case is filed under that instead.
What happened
Reprimand issued to Levales Solicitors LLP (‘Levales’) in respect of Articles 32(1)(b) and 32(1)(d). A threat actor accessed Levales’ cloud-based server using legitimate credentials and subsequently published data on the dark web. The incident affected 8,234 UK individuals, of which 863 individuals were deemed at high risk because of the nature of the data involved. The investigation found Levales were not ensuring the ongoing confidentiality of its processing systems and did not implement appropriate organisational measures.
Summarised from the notice published by the ICO on 21 June 2024. Read the original notice — it is the authoritative version.