Loading story…
A Herefordshire Council employee, Geoffrey Smith, received a suspended prison sentence after unlawfully accessing about 490 sensitive personal records and downloading 94 documents over four days while working in the council's Children and Young People directorate. The records belonged to family members and other people known to him, and included highly sensitive information such as medical records, social worker reports, and child and family assessments involving adults and children.
Smith pleaded guilty to an offence under Section 1 of the UK Computer Misuse Act 1990, and Worcester Magistrates' Court sentenced him to two months' imprisonment suspended for 12 months. The court also ordered 120 hours of unpaid work, £2,000 in costs, and a £154 victim surcharge, while the Information Commissioner's Office said the case reflected a systematic misuse of authorized access given the sensitivity of the data involved.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
At Worcester Magistrates' Court, Smith was sentenced to two months' imprisonment suspended for 12 months for the unlawful access. The court also imposed 120 hours of unpaid work, about £2,000 in costs, and a victim surcharge.
Smith admitted an offence under Section 1 of the UK Computer Misuse Act 1990 for the unauthorized access to the council records. The plea was cited in reporting on the case and sentencing.
While working in Herefordshire Council's Children and Young People directorate, Geoffrey Smith accessed about 490 records and downloaded 94 documents belonging to family members and other acquaintances over a four-day period. The data included medical records, social worker reports, and child and family assessments involving adults and children.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Personal information tied to Victorian regional court online hearings was posted on a dark web hacking forum, triggering a police investigation in Australia. Court Services Victoria said the breach affected participants in online hearings for the Magistrates’ Court and Children’s Court divisions in regional courts, with exposed records including names, email addresses, and job titles. Reporting indicates some of the leaked material also contained highly sensitive details linked to family violence intervention order hearings and children’s court matters. The data was reportedly published in July by a user on an underground forum who claimed responsibility for the leak, raising concerns about direct exposure of court users and sensitive case-related information.
Aug 7, 2026
Ireland’s Data Protection Commission (DPC) fined the Health Service Executive (HSE) **€645,000** after unauthorised individuals accessed paper medical records stored at the disused St. Loman’s Hospital in Mullingar and St. Conal’s Hospital in Letterkenny. The investigation began after the HSE reported two breaches in October and November 2023; videos posted to social media by intruders revealed the records held at the sites. The DPC found that the HSE failed to provide adequate physical security for external document-storage facilities and to preserve the integrity of the archived records. Alongside the financial penalty, imposed on 28 August 2026, the regulator issued a reprimand and ordered the HSE to implement compliance measures and communicate details of the breaches as required.
Sep 5, 2026
The U.K. Information Commissioner’s Office fined South Staffordshire Water’s parent company **£963,900** after finding that the **Cl0p** ransomware group gained access through a phishing email in September 2020 and remained inside the network for about 20 months. The intrusion was discovered only in July 2022 after IT performance issues prompted an internal investigation, which later uncovered a ransom note and the publication of roughly **4.1 TB** of stolen data on the dark web affecting **633,887** customers and employees. The ICO said the breach was enabled by multiple basic security failures, including weak least-privilege controls, limited monitoring, poor vulnerability management, unsupported systems such as **Windows Server 2003**, and unpatched domain controllers vulnerable to **`ZeroLogon`**. Investigators found the attackers moved laterally using a domain administrator account and accessed highly sensitive personal and financial data, including National Insurance numbers and Priority Services Register information that could reveal disabilities; while Cl0p made claims about water supply manipulation, the regulator said its notice did not identify any compromise of operational or water treatment systems.
Jun 29, 2026