Britain’s criminal records office was breached three times over nearly two years, exposing sensitive personal data including records linked to domestic-violence victims. The UK Information Commissioner’s Office said ACRO’s public-facing customer portal, built on Kentico CMS, remained on the same version from September 2019 despite multiple known vulnerabilities and missed fixes; attackers also triggered unreviewed Trend Micro alerts, including Mimikatz detections, and one incident involved SQL injection that exposed employee credentials. Evidence of attacker activity ran from July 2021 to June 2023, and about 11,000 people’s data was staged for possible exfiltration.
Why it matters: This affects highly sensitive police-held personal data and shows how basic failures like unpatched internet-facing systems, unclear patch ownership, and ignored alerts can leave intrusions undetected for months. Public-sector defenders and organizations using Kentico or outsourced portal management should review patch responsibility, investigate alert-handling gaps, and check for credential exposure and long-term persistence.
2026.08.12
95% relevant
This article is a direct update on the same ACRO incident set, adding specifics from the ICO reprimand: attackers kept persistent access to ACRO's website and Kentico CMS from August 2022 to March 2023, ACRO had left Kentico 12.0.0 unpatched since 2019, Trend Micro alerts went unread, and ACRO still cannot determine whether staged data was actually exfiltrated.
2026.08.12
100% relevant
This article establishes the story by tying together the ICO reprimand, the three separate intrusions, the unpatched Kentico customer portal, and the scope of exposed ACRO criminal-records data.
← Back to all stories