Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThe UK Information Commissioner’s Office (ICO) fined Advanced Computer Software Group Ltd £3,076,320 on 27 March 2025 over a ransomware attack on its health and care subsidiary in August 2022. The ICO said personal information belonging to 79,404 people was taken, including details that could help attackers enter the homes of 890 people receiving care at home.
What happened in the August 2022 attack?
Hackers accessed some systems of Advanced’s health and care subsidiary through a customer account that did not have multi-factor authentication (MFA). The ICO’s final findings identified incomplete MFA coverage, insufficient vulnerability scanning and inadequate patch management as security shortcomings. Advanced provides IT and software services to organisations including the NHS and other healthcare providers, processing personal information on their behalf.
The ICO said information was taken from the Staffplan and Caresys products. The final announcement does not establish that the information was published online, so theft should not be conflated with public disclosure.
What information and services were affected?
The final ICO announcement says information belonging to 79,404 people was taken. It included details on how to gain entry to the homes of 890 people receiving care at home—a particularly serious exposure because it could create risks beyond the confidentiality of medical records.
#1 Best Overall
Service availability was a separate impact from data theft. The ICO’s penalty notice says nine customer products were affected in availability for about 658 controller customers. Three products were taken offline as a precaution. Reported unavailability varied by product, from 18 to 284 days; all controller customers were able to access relevant products by 15 May 2023. The incident also disrupted critical services such as NHS 111 and prevented some healthcare staff from accessing patient records.
Why do reports give different fine and victim figures?
The ICO first announced a provisional decision in August 2024. After considering Advanced’s representations, it announced a voluntary settlement and final penalty in March 2025. The final figures, rather than the provisional ones, are the outcome:
| ICO announcement | Penalty | People affected | Status |
|---|---|---|---|
| 7 August 2024 | £6.09 million | 82,946 | Provisional decision |
| 27 March 2025 | £3,076,320 | 79,404 | Final penalty following voluntary settlement |
In reaching the final outcome, the ICO considered Advanced’s representations, including its engagement with the National Cyber Security Centre, National Crime Agency and NHS, as well as other steps to mitigate risk. The ICO’s announcements do not frame the difference as a simple recalculation: the penalty and affected-person count both changed between the provisional and final decisions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why was the software provider responsible?
The ICO distinguishes between a controller, which decides why and how personal information is used, and a processor, which handles information for the controller. A processor still has its own obligation to use appropriate technical and organisational measures to protect the information it processes. The penalty was imposed on Advanced Computer Software Group Ltd, not on the NHS or an individual care provider.
Recommended Free Tools
Rank #3
Information Commissioner John Edwards said the decision was “a stark reminder that organisations risk becoming the next target without robust security measures in place.” He also said: “People should never have to think twice about whether their medical records are in safe hands.”
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
