Advanced Computer Software Group Limited

What the regulator decided

In August 2022 ransomware actors gained access to Advanced's systems through a customer-portal account that did not require multi-factor authentication, and exfiltrated personal information including sensitive health and care data of 79,404 UK individuals, causing widespread disruption to NHS services; Advanced failed to implement appropriate technical and organisational measures to ensure security of processing under Article 32(1) UK GDPR.

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

EUR amount approximate. The original notice of intent in August 2024 was GBP 6.09M; reduced to GBP 3.07M via voluntary settlement. First ICO penalty issued to a processor-only entity under UK GDPR. Cite when a scanner finds a vendor or sub-processor without MFA on an admin or service account - the precedent is that this is itself a 32(1) breach independent of any subsequent compromise.