Cyber attack on the UK's criminal records office compromises criminal conviction data

The UK’s Criminal Records Office (ACRO) suffered a significant cyber security incident that forced it to take its website offline for several days.

ACRO said in a statement on social media that immediately after identifying the security incident, it took the application portal offline and launched an investigation to understand the nature and scope of the cyber attack.

“As soon as we were made aware on 21st March of the incident, we took robust action to take the application portal offline so we could fully investigate. We have emailed all applicants who may have been affected,” ACRO said.



The organisation said the cyber security incident is primarily causing delays in issuing police certificates. However, it is still able to provide services to the police and other agencies, and also continue with criminal record exchanges with overseas countries.

Furthermore, it is accepting applications for police certificates, International child protection certificates, Subject access and record deletion via email.

This update comes after ACRO announced on March 21 that “due to essential website maintenance, online applications are not currently available.” Several media reports, however, state that the ACRO website has been offline since January 17.

ACRO stresses that there is no evidence that personal data has been affected in the security incident, but the possibility of the same cannot be ruled out. The organisation is yet to clarify how threat actors infiltrated its network, what is the nature of the cyber attack, and the number of individuals affected by the security incident.

According to the Evening Standard, the email sent to affected individuals states that threat actors were able to gain access to “identification information and any criminal conviction data.”

The organisation said that it has notified the National Cyber Security Centre (NCSC) about the security incident and is working with them to remediate the incident.

“We are aware of an incident affecting ACRO Criminal Records Office and are working with them to fully understand the impact,” a spokesperson for the NCSC said.