A recent decision by the UK Information Commissioner’s Office (ICO) highlights the serious consequences of failing to implement standard cybersecurity controls. Advanced Computer Software Group Ltd was fined £3.07 million after a ransomware attack in August 2022 that disrupted services for the NHS and exposed the personal data of 79,404 individuals.
What happened?
Attackers gained access to Advanced’s systems through a customer account that lacked multi-factor authentication (MFA).
Sensitive health and personal data, including NHS patient information, was compromised.
The incident caused significant disruption to services such as NHS 111.
The ICO’s investigation found several gaps in Advanced’s security practices, including insufficient MFA rollout and a failure to adequately scan systems for vulnerabilities.
The fine was initially set at £6.09 million but was reduced due to mitigating factors, including cooperation with the investigation.
Why is this a problem?
The MFA was not fully deployed across all systems, leaving accounts exposed to simple credential-based attacks.
Systems were not subject to regular and thorough vulnerability scanning, which may have identified weaknesses before the attack occurred.
Despite operating in a high-risk environment, managing large volumes of special category data, Advanced did not implement sufficient technical and organisational measures to safeguard that data.
These failures fell short of the expectations under Articles 5(1)(f) and 32 of the UK GDPR.
What does it mean for your organisation?
This case reinforces the critical need to get the basics right when it comes to data protection and information security. High-profile breaches like this are not just about complex threats — they often stem from failure to implement well-known controls.
To avoid similar risks, organisations should:
Enforce MFA across all systems and user accounts: especially where sensitive or high-risk data is involved.
Conduct regular vulnerability scans and security audits: outdated software and missed patches create exploitable gaps.
Take a risk-based approach to technical measures: ensure that security practices align with the nature and sensitivity of the data you process.
Establish accountability for cybersecurity: make sure senior management understands the regulatory and reputational impact of poor controls.
The takeaway?
Regulators are making it clear, excuses for missing the fundamentals no longer hold. MFA, system patching, and vulnerability management are minimum standards, not optional extras. Where organisations fail to meet those standards, the financial and operational consequences can be severe.
This decision should prompt all organisations, particularly those in health, finance, or other high-risk sectors, to assess whether their baseline defences are fit for purpose. Because it’s not advanced threats doing the most harm, it’s the failure to put basic protections in place.
Tales from the coalface
Each month, we examine Data Protection issues encountered by our clients. This month, we focus on the risks of excessive internal access and why organisations need to tighten control over who sees what.
Many organisations struggle to let go of data, often keeping it far beyond what is necessary for business, legal, or regulatory purposes. Whether due to uncertainty, convenience, or a misplaced sense of security, excessive data retention increases legal, security, and operational risks, turning what seems like a harmless habit into a significant vulnerability.
Not Everyone Needs the Keys to the Castle
Across sectors, we continue to see a recurring problem: staff with access to far more personal data than they actually need. Whether it’s legacy permissions that were never reviewed, shared team logins, or systems configured with overly broad access by default, these gaps often go unnoticed, until something goes wrong.
What’s the risk of over-permissive access?
Increased risk of internal breaches: The more people who can access personal data, the greater the chance of it being viewed, shared, or misused, whether intentionally or by accident.
Difficulty containing incidents: If a breach occurs, excessive access can make it harder to pinpoint who viewed what, and when.
Poor alignment with Article 32 GDPR: Organisations are required to implement appropriate technical and organisational measures. That includes limiting access to what’s necessary for each role.
Regulatory exposure: In the event of a complaint or breach, regulators often look closely at access logs and permissions. If someone accessed data, they had no reason to see, it raises red flags.
Reputational damage: Internal access issues are hard to explain to the public, especially if sensitive information was involved.
Why it happens:
Over-permissive access often creeps in gradually, not through deliberate decisions, but through overlooked processes and assumptions that go unchallenged.
Access rights are granted “just in case” and never reviewed.
Offboarding processes don’t fully remove system access when staff leave or change roles.
Systems are configured with default access settings that are too broad.
There’s no central visibility or audit trail of who has access to what.
Data is stored in shared drives or folders with unclear ownership or controls.
How to fix it:
The key to reducing access-related risks is to take a structured, policy-driven approach that limits access to only what’s necessary and regularly checks that those limits still make sense.
Implement role-based access controls (RBAC): Staff should only be able to access data necessary for their specific job functions.
Review and audit access rights regularly: Especially when people change roles, leave the organisation, or after any system update or migration.
Maintain an access control policy: Define who approves access, how it’s assigned, and how it’s revoked.
Use audit logs to track access: Ensure that access to systems or records containing personal data can be monitored and reviewed.
Limit shared accounts: Each user should have their own login so actions can be traced. Shared accounts create accountability gaps.
Access controls are more than an IT housekeeping task, they’re a core data protection measure that underpins the integrity of your entire compliance framework. It doesn’t matter how well-written your privacy notice is or how detailed your data protection policy may be , if internal access isn’t controlled, monitored, and justified, the risk remains high.
Without regular reviews, permissions often drift far beyond what’s necessary. People change roles, projects evolve, and systems accumulate layers of outdated access rights that no longer serve a purpose. These lapses create blind spots and blind spots are exactly where breaches happen.
Organisations should treat access as something that must be earned, documented, and periodically reassessed. Just because someone had access last year doesn’t mean they still need it today. Embedding a culture of access accountability, supported by clear policies and technical controls, is essential for maintaining trust, demonstrating compliance, and reducing the likelihood of internal data misuse.
If your organisation needs help reviewing access rights, updating your policies, or conducting a system audit, Ambit Compliance can help.
Contributors to this blog:
Gillian Traynor and Dwayne Morgan
