Loading story…
The UK Information Commissioner’s Office (ICO) fined Police Scotland £66,000 and issued a reprimand after finding “serious” data protection failures tied to the handling of an alleged victim’s mobile phone data. Investigators extracted the entire contents of the phone when only specific communications were needed for a criminal inquiry, resulting in the collection of a substantial volume of highly sensitive “special category” data unrelated to the investigation.
The ICO found that the unredacted full extraction was later mishandled during internal processes: the complete phone dump was included in a professional standards/misconduct disclosure bundle and shared with a third party who should not have received it, exposing sensitive victim information. Reporting emphasized the case as a governance and controls failure around data minimisation, secure handling of digital evidence, and staff training within policing and criminal justice organizations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
The UK Information Commissioner's Office fined Police Scotland £66,000 and issued a reprimand after finding infringements of the Data Protection Act 2018. The ICO also noted the force failed to self-report the personal data breach within the required 72-hour period.
The ICO opened a formal investigation into Police Scotland in response to the complaint and the handling of the victim's mobile phone data. The probe examined both the excessive extraction and the later unlawful disclosure.
The affected victim filed a complaint with the UK Information Commissioner's Office over Police Scotland's handling and disclosure of her phone data. This complaint triggered regulatory scrutiny of the force's actions.
Following the incident and regulatory scrutiny, Police Scotland said it updated its processes, staff training, and oversight arrangements to prevent similar data handling failures. The force also acknowledged shortcomings and apologized.
Police Scotland's Professional Standards Department later included the victim's complete extracted phone data in a misconduct disclosure bundle and shared it with the accused police employee, an unauthorized recipient. The disclosure exposed highly sensitive and special category personal data.
During a criminal investigation, Police Scotland carried out a full mobile phone extraction on an alleged victim's device. The ICO later found this collection was excessive and unfair because it captured sensitive data unrelated to the investigation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A UK local authority disclosed personal data during its complaints-handling process after forwarding complaints to a councillor with **all complainants’ identifying details** included, despite some complainants opting to withhold their names. The information reportedly exposed included sensitive contact details (e.g., home addresses, email addresses, phone numbers) that would not normally be shared with the subject of a complaint, raising a **data protection breach** and governance concerns around how complaint records are processed and redacted. Separately, the UK **Information Commissioner’s Office (ICO)** won a court battle in its long-running attempt to uphold a **£500,000 fine** against **DSG Retail** (owner of *Currys PC World* and *Dixons Travel*) tied to a major 2017 breach in which malware was installed on **5,390 point-of-sale tills** and remained undetected for **nine months**. The incident involved theft of **5.6 million payment card numbers and expiry dates** (without cardholder names) and personal data relating to roughly **14 million individuals**; a central legal dispute is whether the payment card data alone constitutes **personal data** under the applicable pre-GDPR regime. A third item argues for using **tax incentives** (modeled on green-energy policy) to drive “security by design” and improve cybersecurity outcomes, but it is a policy opinion piece rather than reporting on a specific incident or enforcement action.
Jun 29, 2026
UK regulators issued major penalties against online services for inadequate **age assurance** controls intended to protect children. The Information Commissioner’s Office (**ICO**) fined **Reddit £14.47 million** for unlawfully processing children’s data, alleging that despite a stated under-13 prohibition, Reddit did not introduce an age assurance mechanism until **July 2025** and had not completed a required **data protection impact assessment (DPIA)** before **January 2025**. The ICO said these failures potentially exposed minors to inappropriate content and left under-13 users’ personal data collected and used without a lawful basis; Reddit said it intends to appeal. Separately, communications regulator **Ofcom** fined porn operator **8579 LLC £1.35 million** under the UK **Online Safety Act** for failing to deploy “highly effective” age checks (e.g., photo ID matching or credit card checks) to prevent minors from accessing adult content. Ofcom also imposed an additional **£50,000** penalty for allegedly ignoring information requests and warned of an ongoing **£1,000/day** penalty until compliant age verification is implemented, amid broader concerns from civil liberties groups about the privacy and cybersecurity risks of stringent age-verification regimes.
Jun 29, 2026
The U.K. Information Commissioner’s Office fined South Staffordshire Water’s parent company **£963,900** after finding that the **Cl0p** ransomware group gained access through a phishing email in September 2020 and remained inside the network for about 20 months. The intrusion was discovered only in July 2022 after IT performance issues prompted an internal investigation, which later uncovered a ransom note and the publication of roughly **4.1 TB** of stolen data on the dark web affecting **633,887** customers and employees. The ICO said the breach was enabled by multiple basic security failures, including weak least-privilege controls, limited monitoring, poor vulnerability management, unsupported systems such as **Windows Server 2003**, and unpatched domain controllers vulnerable to **`ZeroLogon`**. Investigators found the attackers moved laterally using a domain administrator account and accessed highly sensitive personal and financial data, including National Insurance numbers and Priority Services Register information that could reveal disabilities; while Cl0p made claims about water supply manipulation, the regulator said its notice did not identify any compromise of operational or water treatment systems.
Jun 29, 2026