Who was sanctioned, and for what?

From April to September 2023, attackers used reused credentials to access data on 155,592 people in the United Kingdom, including ancestry, family trees and health information. There was no MFA, no secure password rules and no effective monitoring; despite anomalies in July 2023, the full investigation only began in October. Joint investigation by the UK Information Commissioner's Office (ICO) with the Privacy Commissioner of Canada.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

UK GDPR Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Employees

250 to 999

Culpability

negligent

Published

17 Jun 2025

Original amount 2,310,000 GBP, converted at the ECB reference rate of 5 Jun 2025.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued a reprimand to United Lincolnshire Teaching Hospitals NHS Trust. The ICO found that between March 2021 and March 2022 the trust failed to answer 32% of subject access requests within the one-month statutory deadline. The ICO found infringements of the requirements to respond on time.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Employees

1,000 to 9,999

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued a reprimand to an English NHS university hospital trust. According to the ICO's findings, the hospital answered only 59% of subject access requests on time between 1 August 2022 and 1 July 2023, and 621 requests were still outstanding on 30 January 2024. Until January 2021 requests had been handled in alphabetical order, and the trust extended deadlines across the board without telling the people concerned. The ICO found infringements of Articles 12(3), 15(1) and 15(3) UK GDPR. The date follows from the six-month deadline to 25 September 2024 set in the reprimand and matches the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 25 Mar 2026 · Direct link

The hospital trust was fined £480,000 and ordered to pay £4,286.15 in costs after an employee was found unconscious in a manhole on 1 February 2022 while unblocking a drain and suffered a brain injury. The Health and Safety Executive found that the manhole had not been identified as a confined space and the task had not been properly risk-assessed; there was no safe system of work for clearing blocked drains, and the estates team had not been trained for work in confined spaces.

Authority / court

Wellingborough Magistrates' Court (Anklage: Health and Safety Executive)

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

Section 2(1) Health and Safety at Work etc. Act 1974

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Guilty plea.

Published

9 Jan 2024

Original amount 480,000 GBP, converted at the ECB reference rate of 9 Jan 2024.

Checked against the official source on 3 Oct 2026 · Company name anonymised since 9 Jan 2026 · Direct link

The ICO issued a reprimand to an English NHS hospital trust. According to the ICO's findings, a hospital administrator sent an appointment letter for a child's medical examination to the wrong address, the home of the mother's relatives rather than the father's, together with an advice leaflet, causing significant distress to the family. The ICO criticised the trust for being unable to show a documented process or adequate guidance for handling particularly sensitive correspondence received through unusual channels. It found infringements of Articles 5(1)(f) and 5(1)(d) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) und 5(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 20 Dec 2025 · Direct link

The ICO issued a reprimand to a Scottish regional health board. According to the ICO's findings, an unauthorised individual got onto a hospital ward and, because there were no identity checks and the process was unclear, was handed a handover document containing personal and health data of 14 patients and helped to care for one patient; the document was taken away and has not been recovered. The ICO also criticised the absence of any procedure for recording whether such documents were destroyed at the end of a shift, and an overall training rate of 42%. It found an infringement of Article 5(1)(f) UK GDPR; its reasoning also refers to Article 32(2) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) UK GDPR (in der Begründung zusätzlich Art. 32(2) UK GDPR); Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 23 Nov 2025 · Direct link

The operator of a hospital in Roehampton was fined £140,000, with costs to be decided later. In 2013 a young patient on a specialist psychiatric ward was found unconscious in a lounge and died three days later. The Health and Safety Executive found that the company had not organised in-patient treatment so that patients were not exposed to risks to their health.

Authority / court

Southwark Crown Court (Anklage: Health and Safety Executive)

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

Section 3(1) Health and Safety at Work etc. Act 1974

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Guilty plea.

Published

14 Nov 2023

Original amount 140,000 GBP, converted at the ECB reference rate of 14 Nov 2023.

Checked against the official source on 3 Oct 2026 · Company name anonymised since 14 Nov 2025 · Direct link

The ICO issued a reprimand to an English NHS university hospital trust. According to the ICO's findings, outpatient referrals dropped off the worklist of the electronic referral system after 180 days and were lost to the hospital after more than 550 days; the trust had set up neither a formal process nor training for the manual follow-up. A total of 4,768 people were affected: 4,199 had their referrals delayed and for 569 the data disappeared from the system; some waited more than two years for treatment. The ICO found an infringement of Article 5(1)(f) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 30 Oct 2025 · Direct link

The healthcare group kept two sets of accounting records and, between March 2019 and February 2020, published misleading financial information that understated its debt by around 4 billion USD. The FCA issued a public censure and refrained from imposing a fine so as not to reduce the amounts available to creditors.

Authority / court

Financial Conduct Authority (FCA)

Area of law

Capital markets and financial supervision · Market abuse and insider dealing

Legal basis

Art. 15 i. V. m. Art. 12 Abs. 1 lit. c MAR; s. 123(3) FSMA 2000 (öffentliche Rüge)

Action

Reprimand or warning

Status of proceedings

final

Sector

Healthcare

Published

17 Nov 2023

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 30 Aug 2025 · Direct link

The ICO issued a reprimand to a Scottish regional health board. According to the ICO's findings, between 1 April 2020 and 25 April 2022 staff in one team shared patient data in an unapproved messaging app group with 26 members, including at least 533 entries with names of adults and children, phone numbers, dates of birth, addresses and images containing clinical information; in addition, an unauthorised person was added to the group by mistake. The group was used during the Covid-19 pandemic as a substitute for conversations in the office, without the organisation's knowledge. The ICO found infringements of Articles 5(1)(f), 25(1) and 32(1) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 25(1) und 32(1) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 31 Jul 2025 · Direct link

The ICO issued a reprimand to a patient advocacy body in Northern Ireland. According to the ICO's findings, on 20 January 2021 a member of staff sent an email to the 15 members of an advisory panel being set up for people with lived experience of gender dysphoria and mistakenly put the recipients in CC rather than BCC; 13 of the addresses identified the individual, so health data was disclosed. The ICO considered email using BCC unsuitable given the sensitivity and criticised the lack of guidance on using BCC and an out-of-date email policy. It found infringements of Articles 5(1)(f) and 32(1) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) und 32(1) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 19 Jul 2025 · Direct link

The ICO issued a reprimand to an English NHS university hospital trust. According to the ICO's findings, the trust routinely listed the full postal addresses of other recipients as copy recipients on letters, without seeking their consent or assessing the risk; as a result, one person's address was disclosed to their former partner despite previous allegations of abuse. The ICO also criticised the lack of a process to flag such situations in parental disputes and the lack of training for administrative staff. It found an infringement of Article 5(1)(f) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 25 Apr 2025 · Direct link

The ICO issued a reprimand to a Scottish regional health board. According to the ICO's findings, on 13 June 2019 an invitation was emailed to 37 people without using the BCC function, so all recipients could see the other addresses, most of which contained names; because the recipients were identifiable as likely users of HIV services, the ICO considered the addresses likely to be health data. One recipient recognised at least four other people. The ICO considered that relying on BCC for this group was not the most secure approach and found infringements of Articles 5(1)(f), 32(1) and 25 UK GDPR. According to the reprimand, the ICO had considered a fine of GBP 35,000 but did not impose one because of its revised approach to the public sector since June 2022. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 32(1) und 25 UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 9 Mar 2025 · Direct link

On 7 March 2023 the ICO issued a reprimand to an English NHS hospital trust. According to the ICO's findings, before the licence for an electronic document viewing system expired, the trust downloaded the patient records it held but did not check that the download was incomplete; data of 1,159 people was affected: records of 1,155 people were inaccessible from 19 January 2020 until 12 October 2021, and parts of the records of four patients were permanently lost. There was no decommissioning policy and no adequate oversight; one patient's care planning was affected. The ICO found infringements of Articles 5(1)(f), 24(1) and 24(2) UK GDPR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 24(1) und 24(2) UK GDPR; Verwarnung nach Art. 58 UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 7 Mar 2025 · Direct link

On 10 November 2022 the ICO issued a reprimand to a London NHS hospital trust. According to the ICO's findings, from May 2013 the trust stored hysteroscopy scans on USB sticks for nine years without backing them up to its servers, contrary to its own policy; the two remaining encrypted sticks became inaccessible on 5 April 2018, affecting between 4,000 and 10,000 people. The trust did not initially recognise the incident as a personal data breach and reported it late; there were no risk assessments, no training and no designated information asset owners. The ICO found infringements of Articles 5(1)(f) and 24(1) UK GDPR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) und 24(1) UK GDPR; Verwarnung nach Art. 58 UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 10 Nov 2024 · Direct link