Who was sanctioned, and for what?

The provider of a travel booking system continued to provide services to Ural Airlines, designated in May 2022, requested payments of around 906,600 USD and, after the funds were frozen by the bank, looked for alternative payment routes, which HM Treasury's Office of Financial Sanctions Implementation (OFSI) regarded as circumvention. A lack of escalation during a change of roles, vacant leadership positions in legal and compliance, policies focused on US law and screening that did not flag the designation all contributed. According to the annual accounts filed with the UK companies register for financial year 2024, the company had around 150 employees.

Authority / court

HM Treasury, Office of Financial Sanctions Implementation (OFSI)

Area of law

Sanctions and export control · Breaches of sanctions and embargoes

Legal basis

Russia (Sanctions) (EU Exit) Regulations 2019, regs. 13, 14, 19

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Employees

50 to 249

Mitigating circumstances

Voluntary disclosure (31 October 2022) and full cooperation; settlement under the new settlement procedure

Published

17 Jun 2026

Original amount 1,000,920.59 GBP, converted at the ECB reference rate of 26 May 2026.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

On 19 March 2026 OFSI imposed a monetary penalty of GBP 390,000 on Ireland-based Apple Distribution International Limited by way of settlement. According to OFSI's findings, the company, which pays out revenues to software developers on an app marketplace, instructed two payments totalling GBP 635,618.75 in June and July 2022 from a UK bank account to a Russian app developer owned by a designated entity, and did not cancel the instructions. OFSI identified reliance on developers' self-declarations and on third-party data, among other things, as causes. The company had voluntarily disclosed the payments on 4 October 2022. The settlement followed a notice of intent of 11 November 2025 and was reached under the settlement process introduced in February 2026; OFSI made no findings against the parent company. Source: Office of Financial Sanctions Implementation (OFSI), HM Treasury, "Imposition of monetary penalty: Apple Distribution International Limited", 30 March 2026, https://www.gov.uk/government/publications/imposition-of-monetary-penalty-apple-distribution-international-limited. Contains public sector information licensed under the Open Government Licence v3.0 (https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/).

Authority / court

HM Treasury, Office of Financial Sanctions Implementation (OFSI)

Area of law

Sanctions and export control · Breaches of sanctions and embargoes

Legal basis

Russia (Sanctions) (EU Exit) Regulations 2019, reg. 12; Geldbuße nach s. 146 Policing and Crime Act 2017 (Settlement)

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Published

30 Mar 2026

Original amount 390,000 GBP, converted at the ECB reference rate of 19 Mar 2026.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

In 2022, an attacker first compromised an employee's company laptop and then the personal laptop of a senior employee, whose master password he captured using a keylogger. Because the personal and business password vaults were linked via the same master password, he obtained the access and decryption keys stored there and stole data on up to 1.6 million UK users from the backup database. According to the annual accounts filed with the UK companies register for financial year 2025, the company had around 35 employees.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

UK GDPR Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1 lit. f

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

Under 50

Culpability

negligent

Published

11 Dec 2025

Original amount 1,228,283 GBP, converted at the ECB reference rate of 20 Nov 2025.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

Advanced, a processor for the NHS and care providers, was attacked with ransomware in August 2022 via a customer account without multi-factor authentication; services such as NHS 111 were disrupted. Data on 79,404 people was stolen, including instructions on how to gain entry to the homes of 890 people receiving care at home.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data processors

Legal basis

UK GDPR Art. 32 Abs. 1 (als Auftragsverarbeiter)

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Culpability

negligent

Mitigating circumstances

Provisionally £6.09 million; reduced, among other things, for proactive cooperation with the NCSC and the National Crime Agency.

Published

27 Mar 2025

Original amount 3,076,320 GBP, converted at the ECB reference rate of 26 Mar 2025.

Checked against the official source on 25 Sep 2026 · Direct link

On 16 November 2023 the ICO fined a UK company that generates mobile and broadband leads for communications providers GBP 70,000. According to the ICO's findings, between 1 January and 11 November 2021 subscribers received 1,164,877 marketing texts and emails sent by the company without valid consent. Some of the consents came from third-party websites; the ICO considered them not freely given, because people could only agree by accepting calls, emails and texts together, and in some cases neither specific nor informed. The ICO became aware of the company through 1,103 complaints to the 7726 spam reporting service and treated the conduct as a breach of regulation 22 of PECR. Under the notice, early payment reduced the fine to GBP 56,000.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulation 22 PECR; section 55A DPA 1998 (Geldbuße)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Original amount 70,000 GBP, converted at the ECB reference rate of 16 Nov 2023.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 16 Nov 2025 · Direct link

On 26 October 2023 the ICO fined a UK platform for sending marketing texts GBP 65,000 and served an enforcement notice on the same day. According to the ICO's findings, between 1 January 2021 and 31 January 2022 subscribers received 2,330,423 marketing texts without valid consent; the company sent 24,309 of them itself, and its clients sent the remaining 2,306,114 over lines that it allowed them to use. The company relied on legitimate interests rather than consent, and the messages it sent itself did not identify the sender. The ICO treated this as a breach of regulations 22 and 23 of PECR. Under the notice, early payment reduced the fine to GBP 52,000.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulation 22 (einschließlich 22(4)) und 23 PECR; section 55A DPA 1998 (Geldbuße); section 40 DPA 1998 (Enforcement Notice) wegen Regulation 22 PECR

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Original amount 65,000 GBP, converted at the ECB reference rate of 26 Oct 2023.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 26 Oct 2025 · Direct link

On 9 May 2023 the ICO fined a UK provider of business telecommunications solutions GBP 80,000 and served an enforcement notice on the same day. According to the ICO's findings, between 13 September 2021 and 31 January 2022 the company made 72,682 unsolicited marketing calls to subscribers registered with the TPS or CTPS. The ICO treated this as a breach of regulation 21 of PECR. Under the notice, payment by 8 June 2023 reduced the fine to GBP 64,000. The ICO published the case on 16 May 2023.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulation 21 PECR (Enforcement Notice: regulation 21(1)(a) und (b)); section 55A DPA 1998 (Geldbuße); section 40 DPA 1998 (Enforcement Notice)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Original amount 80,000 GBP, converted at the ECB reference rate of 9 May 2023.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 9 May 2025 · Direct link

On 20 September 2022 the ICO issued a reprimand to a UK telecoms and broadband provider. According to the ICO's findings, between 1 July and 31 December 2021 the company failed to answer 14 per cent (1,316) of the subject access requests it received on time; in the same period the company received 493 complaints about its handling of such requests, 95 per cent of them about delays. In 2021 the ICO itself received 125 complaints about the company's subject access compliance, 51 per cent of all complaints it received about the company that year. The ICO found infringements of Articles 12(3), 15(1) and 15(3) UK GDPR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; Verwarnung nach Art. 58 UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Telecoms, IT and software

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 20 Sep 2024 · Direct link