Who was sanctioned, and for what?

According to the Federal Trade Commission (FTC, the US consumer protection authority), three attacks between 2014 and 2020 affected more than 344 million guests worldwide, including 5.25 million unencrypted passport numbers; one intrusion went undetected for 14 months. The FTC alleges inadequate password, access, firewall and segmentation controls, failure to patch, insufficient logging and too little MFA; the order finalised in December 2024 requires a security programme with annual certification to the FTC for 20 years, independent assessments every two years, data minimisation and a deletion option for US customers. In parallel, Marriott pays 52 million USD to 49 states and Washington, D.C.

Authority / court

Federal Trade Commission (FTC)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Section 5 FTC Act

Action

Order

Status of proceedings

final

Sector

Other

Employees

10,000 or more

Published

20 Dec 2024

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued a reprimand to a law firm specialising in criminal and military law. According to the ICO's findings, an unknown attacker used valid credentials to get into the firm's cloud server and later published data on the dark web. The incident affected 8,234 people in the UK, 863 of them at high risk because criminal proceedings data was involved. The ICO criticised the lack of multi-factor authentication and of a password policy for the compromised administrator account, and the fact that the firm had not checked since 2012 whether the security measures in its contract with its outsourced IT provider were adequate. It found infringements of Articles 32(1)(b) and 32(1)(d) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Other

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 21 Jun 2026 · Direct link

The ICO issued a reprimand to a UK recruitment company. According to the ICO, an unauthorised third party gained access to its systems twice within twelve months, around 13 March 2022 and around 16 August 2022, probably by SQL injection each time, and exfiltrated data; 13,720 and 4,421 UK individuals respectively were affected, some of them including bank account numbers. According to the ICO's findings, the company knowingly ran unsupported versions of its database and scripting software, used poorly written code without adequate input validation and had insufficient logging, and did not carry out regular security testing. The ICO found infringements of Article 32(1), 32(1)(b) and 32(1)(d) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 32(1), 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Other

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 19 Oct 2025 · Direct link

On 10 March 2023 the ICO issued a reprimand to a UK online trading provider. According to the ICO's findings, on 14 April 2020 an unauthorised third party exploited an unpatched vulnerability in third-party software it used to access the company's systems and exfiltrate 17.92 GB of data; 72,361 UK data subjects were affected, with names, email addresses, bank account numbers and sort codes involved. The company had no patch management programme and was not applying security patches, although its support contract made this its own responsibility. The ICO considered the case under the GDPR as it applied at the time and found infringements of Article 32(1) and 32(1)(b) GDPR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 32(1) und 32(1)(b) GDPR; Verwarnung nach Art. 58(2)(b) GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Other

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 10 Mar 2025 · Direct link

On 21 February 2023 the ICO issued a reprimand to a UK financial services professional body; its case page lists the reprimand as issued. The published letter, however, is worded as an announcement and provisional decision ("we intend to issue", "provisionally decided", "alleged infringements"); the ICO has not published a version in final wording. As described by the ICO, on 17 February 2020 an attacker used a known weakness in the website software and a brute-force attack to plant malicious code on the payment page; the code harvested card details of an estimated 3,883 people in the UK, along with names and email addresses, and 654 people reported card fraud. According to the ICO, a forensic investigation commissioned by the body found that it was running unsupported software and that a patch for one critical flaw had been available since 2017; The body said it had not carried out penetration tests before the incident. The ICO provisionally considered that Articles 32(1), 32(1)(b) and 32(1)(d) UK GDPR had been infringed.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 32(1), 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Other

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 21 Feb 2025 · Direct link