ACRO’s three-year‑long data breaches expose thousands, regulator slaps reprimand
ACRO Criminal Records Office suffered three separate intrusions between July 2021 and June 2023, each exploiting an unpatched Kentico CMS and ignored Trend Micro alerts. The attacks exposed personal data of thousands, including domestic‑violence victims, prompting the ICO to issue a formal reprimand for systemic security failures.