No MFA? Expect Hefty Fines, UK’s ICO Warns

The ICO fined IT provider Advanced £3.07m following a 2022 ransomware breach that exposed data for 79,404 people and disrupted NHS services; attackers accessed a health subsidiary via a customer account without MFA, and inadequate vulnerability scanning and patch management also contributed. The fine was halved after Advanced engaged with authorities and victims; the ICO warned that greater fines will follow when basic controls such as MFA are not implemented.