Who was sanctioned, and for what?

When the nickel price rose to over 100,000 USD within just over an hour on 8 March 2022, only junior staff were on duty during Asian trading hours, and they had not been trained to recognise a disorderly market; they did not escalate and even switched off price bands. The Financial Conduct Authority (FCA) imposed a fine on the recognised investment exchange for the first time: 9.2 million GBP after a 30% discount.

Authority / court

Financial Conduct Authority (FCA)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

FCA REC 2.5.1 (Recognition Requirements); Art. 18 RTS 7 (MiFID II)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Early settlement (30% discount); improvements since March 2022.

Original amount 9,200,000 GBP, converted at the ECB reference rate of 20 Mar 2025.

Checked against the official source on 25 Sep 2026 · Direct link

On 5 July 2024 the ICO issued an (updated) reprimand to a London borough council. According to the reprimand, it followed a ransomware attack that the council became aware of on 11 October 2020: the attacker was able to access and encrypt 440,000 files containing personal data, including special category data, relating to at least 280,000 residents and other people, including staff. According to the ICO's findings, patch management and user account management were inadequate, in breach of Articles 5(1)(f) and 32(1)(b) UK GDPR. The ICO had initially considered a fine but, taking into account its approach to the public sector and the circumstances of the case, decided on a reprimand.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 5 Jul 2026 · Direct link

The ICO issued a reprimand to a law firm specialising in criminal and military law. According to the ICO's findings, an unknown attacker used valid credentials to get into the firm's cloud server and later published data on the dark web. The incident affected 8,234 people in the UK, 863 of them at high risk because criminal proceedings data was involved. The ICO criticised the lack of multi-factor authentication and of a password policy for the compromised administrator account, and the fact that the firm had not checked since 2012 whether the security measures in its contract with its outsourced IT provider were adequate. It found infringements of Articles 32(1)(b) and 32(1)(d) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Other

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 21 Jun 2026 · Direct link

The ICO issued a reprimand to a UK public body. According to the ICO's findings, unknown attackers got into the body's on-premises email server from 24 August 2021 via a chain of known vulnerabilities; the data affected came mainly from the electoral register, with the names and home addresses of around 40 million people. The security patches for these vulnerabilities had been released in April and May 2021 but had not been applied. In addition, an audit found that 178 active accounts could be cracked quickly because their passwords were identical or similar to the initial passwords issued by the service desk. The ICO found infringements of Articles 5(1)(f) and 32(1)(b) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 9 May 2026 · Direct link

The ICO issued a reprimand to an English multi-academy trust, which runs schools. According to the ICO, an unauthorised third party used compromised credentials to access and encrypt the trust's systems. According to the ICO's findings, appropriate technical measures were missing: the account lockout policy was inadequate and reversible password encryption was enabled, contrary to National Cyber Security Centre recommendations. The ICO found infringements of Articles 5(1)(f) and 32(1)(b) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 7 Dec 2025 · Direct link

The ICO issued a reprimand to a UK supplier of construction materials. According to the ICO, on 11 March 2022 a threat actor gained access to the network, deployed ransomware and exfiltrated data, including personal data of 2,022 current and former UK employees (among other things identity documents, bank details and HR records). According to the ICO's findings, access was gained through a subsidiary's remote desktop service that had no multi-factor authentication; in addition, the company had carried out no formal security testing such as vulnerability scanning or penetration testing before the incident, and the attacker exploited a vulnerability that had been public for more than two years. The ICO found infringements of Article 32(1), 32(1)(b) and 32(1)(d) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 32(1), 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Construction and real estate

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 14 Nov 2025 · Direct link

The ICO issued a reprimand to a UK recruitment company. According to the ICO, an unauthorised third party gained access to its systems twice within twelve months, around 13 March 2022 and around 16 August 2022, probably by SQL injection each time, and exfiltrated data; 13,720 and 4,421 UK individuals respectively were affected, some of them including bank account numbers. According to the ICO's findings, the company knowingly ran unsupported versions of its database and scripting software, used poorly written code without adequate input validation and had insufficient logging, and did not carry out regular security testing. The ICO found infringements of Article 32(1), 32(1)(b) and 32(1)(d) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 32(1), 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Other

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 19 Oct 2025 · Direct link

The ICO issued a reprimand to a UK business services group. According to the ICO case page, the company suffered a ransomware attack in which personal data was exfiltrated. According to the ICO's findings, there was no clear bring-your-own-device policy and no adequate account lockout policy, and multi-factor authentication had not been set up for the affected user account. As aggravating factors, the ICO noted that data had been kept for longer than necessary and that it took eleven months to notify everyone affected. The ICO found infringements of Articles 5(1)(f) and 32(1) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 5(1)(f) und 32(1) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Financial services and insurance

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 10 Oct 2025 · Direct link

The FCA fined a UK credit reference agency £11,164,400. The FCA found that the agency had outsourced the processing of UK consumer data to its US parent without adequately overseeing the security of that data, even though it knew of problems with security patching. In the 2017 cyber attack on the parent company, data of millions of people in the UK were also taken. In the FCA's view, subsequent public statements on the impact on UK consumers failed to be fair, clear and not misleading. The fine includes a 30% discount.

Authority / court

Financial Conduct Authority (FCA)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

FCA Principles 3, 6 und 7; section 206 FSMA 2000

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Original amount 11,164,400 GBP, converted at the ECB reference rate of 3 Oct 2023.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 3 Oct 2025 · Direct link

On 23 August 2023 the ICO issued a reprimand to an English city council. According to the ICO's findings, before a ransomware attack the council had no centralised logging or SIEM system; the attacker was able to delete logs, which hampered detection and investigation. After the attack the council did not restore access to personal data in a timely manner, could not identify which individuals were at risk and relied on ad hoc processes to analyse the data, such as downloads over employees' home Wi-Fi networks. The ICO found infringements of Article 32(1)(b), 32(1)(c) and 32(1)(d) UK GDPR. The ICO enforcement list shows the case under 1 September 2023.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 32(1)(b), 32(1)(c) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 23 Aug 2025 · Direct link

The ICO issued a reprimand to a UK company operating a video platform; its case page lists the reprimand as issued. The published document, however, is worded as a provisional decision, referring to provisional findings and alleged infringements; the ICO has not published a version in final wording. As described by the ICO, around 14 August 2022 an unauthorised person got into the company's systems and copied the names, email addresses and passwords of 345,000 UK users; the company could not say exactly how this happened. The ICO provisionally criticised the company for being unable to show which security measures were in place at the time, or that it carried out regular penetration tests or vulnerability scans, and for relying on assurances from service providers without showing contracts or oversight. It considered that Article 32(1) and 32(1)(d) UK GDPR had been infringed. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 32(1) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Media and online platforms

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 25 Jul 2025 · Direct link

On 10 March 2023 the ICO issued a reprimand to a UK online trading provider. According to the ICO's findings, on 14 April 2020 an unauthorised third party exploited an unpatched vulnerability in third-party software it used to access the company's systems and exfiltrate 17.92 GB of data; 72,361 UK data subjects were affected, with names, email addresses, bank account numbers and sort codes involved. The company had no patch management programme and was not applying security patches, although its support contract made this its own responsibility. The ICO considered the case under the GDPR as it applied at the time and found infringements of Article 32(1) and 32(1)(b) GDPR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 32(1) und 32(1)(b) GDPR; Verwarnung nach Art. 58(2)(b) GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Other

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 10 Mar 2025 · Direct link

On 21 February 2023 the ICO issued a reprimand to a UK financial services professional body; its case page lists the reprimand as issued. The published letter, however, is worded as an announcement and provisional decision ("we intend to issue", "provisionally decided", "alleged infringements"); the ICO has not published a version in final wording. As described by the ICO, on 17 February 2020 an attacker used a known weakness in the website software and a brute-force attack to plant malicious code on the payment page; the code harvested card details of an estimated 3,883 people in the UK, along with names and email addresses, and 654 people reported card fraud. According to the ICO, a forensic investigation commissioned by the body found that it was running unsupported software and that a patch for one critical flaw had been available since 2017; The body said it had not carried out penetration tests before the incident. The ICO provisionally considered that Articles 32(1), 32(1)(b) and 32(1)(d) UK GDPR had been infringed.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 32(1), 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Other

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 21 Feb 2025 · Direct link

Following the migration to a new IT platform in April 2018, customers were able to carry out banking transactions in branches, by telephone and online only to a limited extent for months; all branches and a large proportion of the 5.2 million customers were affected. The Financial Conduct Authority (FCA) and the Prudential Regulation Authority (PRA) accused the bank of deficient planning, governance and management of outsourcing risk and imposed a total of 48.65 million GBP (FCA 29.75 million, PRA 18.9 million).

Authority / court

Financial Conduct Authority (FCA) und Prudential Regulation Authority (PRA)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

FCA- und PRA-Anforderungen an operationelles Risikomanagement, Governance und Auslagerung

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

30% discount for settlement; 32.7 million GBP in compensation already paid to customers.

Original amount 48,650,000 GBP, converted at the ECB reference rate of 20 Dec 2022.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 20 Dec 2024 · Direct link

On 19 October 2022 the ICO fined the parent company of a UK construction group GBP 4,400,000. According to the ICO's findings, after a phishing email received on 30 March 2020 was forwarded internally, malware was installed on a workstation on 1 April 2020. The attacker went on to compromise 283 systems and 16 accounts, 12 of them privileged, uninstalled the anti-virus software and encrypted, among other things, four HR databases holding data of up to 113,000 employees, including special category data; according to the ICO, the company identified the incident as a ransomware attack on 2 May 2020. The ICO criticised, among other things, unsupported operating systems, outdated protocols, inadequate endpoint protection, a lack of regular vulnerability scanning and penetration testing, and gaps in training, incident response and privileged account management. It found infringements of Articles 5(1)(f) and 32 GDPR for the period from 18 March 2019 to 1 December 2020. The ICO published the case on 24 October 2022.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 5(1)(f) und 32 GDPR; Geldbuße nach section 155 DPA 2018 und Art. 83 GDPR

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Original amount 4,400,000 GBP, converted at the ECB reference rate of 19 Oct 2022.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 19 Oct 2024 · Direct link