Sanction RGPD Information Commissioner (ICO) — Advanced Computer Software Group Ltd : 3,5 M€ (2025)
- Autorité de contrôle
- Information Commissioner (ICO)
- Pays
- Royaume-Uni
- Entreprise / secteur
- Advanced Computer Software Group Ltd
- Montant de l'amende
- 3,5 M€
- Date de la décision
- 26 mars 2025
- Fondement juridique
- Art. 32 (1)
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The UK DPA (ICO) has fined Advanced Computer Software Group Ltd £3.07 million (EUR 3.5 million) for insufficient IT security (infringiment of Art. 32 (1) UK GDPR). The controller failed to implement appropriate technical and organisational measures to protect personal data. A ransomware attack in August 2022 allowed hackers to access systems of a health subsidiary via a customer account that lacked multi-factor authentication. As a result, the personal data of 79,404 individuals was put at risk.