ICO admits internal data breach

The Information Commissioner’s Office has been forced to admit its own systems have suffered a highly embarrassing data breach, despite claiming to DecisionMarketing that its website was “as safe as houses”.
DecisionMarketing submitted a Freedom of Information request two months ago, in which the regulator said its site had never once been compromised in the past five years.
It said on only two occasions where hackers nearly got through the ICO’s ring of steel. The first was between 23 April 2012 and 21 May 2012, when the availability of the website was affected; the second was between 11 and 12 February 2014.
But buried on page 46 of its 84-page annual report, published earlier this week, the ICO admitted it had been hit by what it described as a “non-trivial data security incident” that prompted a “full internal investigation”.
It stated: “There has been one non-trivial data security incident. The incident was treated as a self-reported breach. It was investigated and treated no differently from similar incidents reported to us by others. We also conducted an internal investigation.
“It was concluded that the likelihood of damage or distress to any affected data subjects was low and that it did not amount to a serious breach of the Data Protection Act. A full investigation was carried out with recommendations made and adopted. The internal investigation was also concluded.”
The ICO refused to reveal any more information about the incident.