Three intrusions at UK criminal records office went undetected for two years

## Executive summary The ICO reprimanded ACRO after three intrusions (July 2021–June 2023) that exploited an unpatched Kentico customer portal and ignored antivirus/security alerts; attackers staged sensitive data for nearly 11,000 people, Mimikatz-related activity was detected but not acted upon, and the Medusa ransomware group later claimed responsibility though exfiltration was unconfirmed. ACRO has decommissioned the compromised infrastructure and deployed a new SIEM, while the ICO noted network segmentation limited impact.