UK Information Commissioner’s Office Cracks Down on Lax Security Controls

The Information Commissioner’s Office (ICO) is stepping up enforcement against organisations failing to implement essential cyber-defences. Here’s a sharp overview of the latest actions, especially focused on the absence of security measures like Multi-Factor Authentication (MFA), patching, and access controls.

Major Fines for Weak Authentication

• Advanced Computer Software Group Ltd (a supplier to the NHS) received a £3.07 million fine in March 2025. The ICO found hackers accessed its systems via a customer account without MFA, breaching Article 32 of UK GDPR. This incident exposed data on nearly 79,404 individuals, including sensitive health and access details for vulnerable persons.
• The ICO underscored its shift to targeting data processors directly, noting the company’s security measures were “seriously short” of legal expectations.

Smaller but Significant Penalties

DPP Law Ltd, a law firm, was fined £60,000 in April 2025. A cyber‑attack exploited an administrative account lacking MFA and led to 32 GB of confidential data being posted online. The ICO noted inadequate patch management and vulnerability spotting.

ICO’s Clear Warning: No MFA, No Mercy

Deputy Commissioner Stephen Bonner declared any breach caused by missing MFA across external access points could now face “hefty penalties.” He emphasised that MFA is “mature, straightforward” and “there’s no excuse” for omitting it.

Broader Trend: Security Failings Front and Centre

A BDO analysis of 25 ICO enforcement actions (July 2024–Feb 2025) marks inadequate security measures, especially missing MFA and cloud server deficiencies, as recurrent triggers. In one case, a law firm’s failure to protect a cloud server led to data being published on the dark web.

What These Actions Signal for Your Business

1. Data Processors hold equal responsibility: The ICO’s landmark processor fine shows they must meet GDPR security standards just like data controllers.
2. MFA is mandatory: This is no longer best practice, it’s expected. Any breach without it risks enforcement action.
3. Ensure comprehensive defence: Expectations now extend beyond MFA to include patch management, vulnerability scanning, and timely breach response.
4. Small firms aren’t exempt: Even smaller entities, like DPP Law, have incurred notable fines, demonstrating that organisation size is not a shield.
5. Prevention is cheaper than cure: The ICO often credits proactive remediation, like vulnerability scanning and swift breach handling, with reducing penalties.