cyber.hendryadrian.com
Cyber Attack & Data Breach · therecord.media

ICO Reprimands ACRO After Three Intrusions Exposed Sensitive Data

· Original article ↗

Summary

The UK ICO reprimanded ACRO over three intrusions from 2021–2023 exploiting an unpatched Kentico portal. Attackers staged data on nearly 11,000 people, but the ICO said ACRO could not confirm exfiltration; Medusa’s responsibility claim remains unverified.

Key points

  • The ICO said ACRO suffered three intrusions between July 2021 and June 2023 through a public-facing portal running an unpatched Kentico version.
  • During the most serious incident, an attacker maintained access for about seven months and staged sensitive data on just under 11,000 people for exfiltration; insufficient logs meant ACRO could not confirm whether data was taken.
  • Trend Micro alerts, including four detections of attempts to install Mimikatz, were not acted on.
  • One other incident involved SQL injection that exposed employee credentials.
  • Network segmentation prevented movement from the compromised web environment into the core policing system, according to the ICO.
  • Medusa claimed responsibility, but the claim was not confirmed and no stolen data appeared on its leak site.
  • ACRO decommissioned the compromised infrastructure and implemented a new security information and event management system.

Article Details

Victim Organization
ACRO Criminal Records Office
Incident Type
Three intrusions exploiting an unpatched public-facing Kentico portal, including an SQL injection that exposed employee credentials.
Incident Date
2021-07-09
Data Types Exposed
  • Sensitive personal data
  • Information linked to domestic violence victims
  • Employee credentials
Affected Records
Data belonging to just under 11,000 people was staged for exfiltration during one incident, but ACRO could not confirm whether it was exfiltrated. More than 84,000 people were notified as potentially at risk; this was a precautionary notification, not a confirmed count of affected records.
Operational Impact
The compromised web environment was decommissioned. Network segmentation prevented movement into the core policing system. ACRO implemented a new security information and event management system.
Ransom Or Extortion
Medusa claimed responsibility. No stolen data was published on its leak site. Whether a payment was made or the claim was fabricated is unknown.
Claim Status
confirmed

MITRE ATT&CK

T1003 · OS Credential DumpingTrend Micro detected and quarantined four attempts to install Mimikatz, described as a credential-harvesting tool; successful execution was not reported.T1190 · Exploit Public-Facing ApplicationThe intrusions exploited vulnerabilities in ACRO's public-facing Kentico portal; one incident also involved SQL injection.

Threat Actors

MedusaThe ransomware group claimed responsibility for the ACRO intrusions. The article says it is unclear whether the claim was genuine; no stolen data was published on its leak site.

Vendors

KenticoThe incidents involved unpatched Kentico flaws, ignored Trend Micro alerts, and an attempted Mimikatz deployment, with the Medusa ransomware group later claiming responsibility.Trend MicroThe incidents involved unpatched Kentico flaws, ignored Trend Micro alerts, and an attempted Mimikatz deployment, with the Medusa ransomware group later claiming responsibility.

Products

Kentico CMSThe incidents involved unpatched Kentico flaws, ignored Trend Micro alerts, and an attempted Mimikatz deployment, with the Medusa ransomware group later claiming responsibility.

Tools

MimikatzThe incidents involved unpatched Kentico flaws, ignored Trend Micro alerts, and an attempted Mimikatz deployment, with the Medusa ransomware group later claiming responsibility.

Countries

BritainBritain’s ACRO Criminal Records Office was reprimanded by the ICO after repeated breaches over nearly two years exposed sensitive personal data, including information linked to domestic violence victims.

Related Articles