The ICO’s final record states a £3.07 million fine concerning security failings that put 79,404 people’s personal information at risk.
ICO · inspect the source ↗INCIDENT BRIEF / SECURITY & PRIVACY
Advanced’s ICO record: verify MFA coverage at the actual access path
The ICO’s final enforcement record describes an account without MFA in the access path to a healthcare subsidiary. The practical lesson is to verify coverage and exceptions for real accounts, rather than treating a policy statement as proof.
01 / SOURCE-ATTRIBUTED REPORTING
What the evidence establishes.
The regulator links its action to an August 2022 ransomware incident and says access occurred through a customer account without MFA in the health and care subsidiary. It also records reports of NHS 111 disruption.
ICO · inspect the source ↗02 / KEEP THE SEQUENCE
A dated record.
Incident month recorded
The enforcement summary dates the ransomware incident to August 2022; it does not give an exact day here.
Source reference ↗
Dates and time zones follow the cited report where specified. A report date is distinct from the incident date and from our review.
03 / GOVERNATLAS EDITORIAL ANALYSIS
Make the lesson useful.
These are proposed review and trial activities inspired by the reported event. They are not completed tests or claims that a particular control guarantees prevention.
Verify coverage, exceptions and enforcement separately.
A supplier’s statement that MFA is available does not establish that it is enforced for the access path you will use. Separate interactive users, customer administration, recovery accounts and service identities. Ask how exceptions are approved and discovered, and retain the boundary of any demonstration instead of generalizing it to the entire service.
BRING THIS INTO YOUR REVIEW
Test data access governance ↗Choose a representative customer account and verify the documented sign-in policy in an authorized test. Record recovery behavior, exception handling and the owner responsible for reviewing coverage gaps.
Keep the final record distinct from earlier reporting.
Regulatory reporting can change between a provisional announcement and a final decision. Preserve the date and status of the record used in a supplier review. If a number or conclusion changes, update the decision trail so readers can see which version supports it and which statements remain outside its scope.
BRING THIS INTO YOUR REVIEW
Review security questionnaires against evidence ↗For any enforcement claim in a questionnaire response, request the final primary record, identify the relevant legal entity and separate completed remediation evidence from a promised action.
FROM READING TO A REVIEW YOU CAN OWN
What will you examine next?
A reported failure is a reason to ask a precise question about your own service. It does not establish that your configuration shares the same weakness. Start with the workflow, deployment and dependencies you can identify, then decide which proposed activity is relevant.
For each relevant lesson, name an accountable role, describe the evidence you would request and define an authorized trial before performing it. Keep “not checked” distinct from a recorded observation. If a check reveals a gap, retain its scope and next action rather than converting the observation into a supplier-wide verdict.
Use this portable record in a review, renewal discussion or continuity exercise. A material configuration change, a revised incident account or the completion of an action can trigger your next review. Your entries remain your working notes; publication evidence and your own acceptance decision are separate records.
Use non-sensitive roles and evidence references. Entries stay in this open page and reset on reload; download before leaving. This tool performs no tests and produces no readiness score.
2 unassigned owners · 2 activities not checked
Define a safe, measurable rehearsal
Record the normal result before changing anything. Agree an authorized test boundary, an observable stop condition and who can stop the exercise. Check restored configuration and unfinished work separately. These entries are your plan, not permission to test a service.
04 / LEAVE UNCERTAINTY VISIBLE
What this record does not establish.
This is a summary of the regulator’s final public record, not a new legal opinion or a determination of the supplier’s current compliance.
The captured summary does not establish present-day controls, every affected organization or an exact incident day.
Geography: Country-level context follows the ICO’s account of NHS service disruption. The centroid does not identify a patient, a facility or an attacker’s origin.
05 / THE EVIDENCE RECORD
Sources & editorial review.
ICO final enforcement record for Advanced Computer Software ↗
ICO · captured 2026-10-16 (UTC)
Inspect preserved provenance
- Source
- 27f4a0d6-b4a4-4b7f-b786-522143dc13bd
- Observation
- 3f93dd7e-884e-49a8-bd46-90c1d20d64e9
- SHA-256
- 7f96846f0bde9cbea635d9d8808c4fc4fe6878b807124bff2e426196e0b8b27f
Reporting and proposed methods by GovernAtlas editorial. Published review: 2026-10-17 (UTC). Revision 1. Preserved source bytes identify the material reviewed; they do not independently verify the provider’s account.
Submit a correction with supporting evidence ↗