Hazard

Reprimands · Finance insurance and credit

Optionis Group Limited

No fineReprimands
Root cause Ransomware An attacker encrypted or stole data and demanded payment. Usually the visible end of a chain that started with an unpatched service or a stolen credential.

What happened

The data controller suffered a ransomware attack, which resulted in the exfiltration of personal data. A reprimand was issued in respect of specific infringements of the UK GDPR, which include lack of multi-factor authentication, an inadequate account lockout policy, and no clear Bring Your Own Device policy.

Summarised from the notice published by the ICO on 10 October 2023. Read the original notice — it is the authoritative version.

The other end of this

Ransomware crews get in somehow. These are vulnerabilities CISA has tied directly to ransomware campaigns — each one is a live route into an organisation like this one.

All exploited vulnerabilities →