UK ACRO Criminal Records Office Data Breach
The UK Information Commissioner's Office (ICO) issued a formal reprimand in August 2026 to the ACRO Criminal Records Office, the national policing body that manages criminal record disclosures and Police Certificates for visa and immigration applications, following a major cyberattack and data protection failure.
Exposed Data Types
1 sensitive11- Biometric data
- Names
- Dates of birth
- Physical addresses
- Email addresses
- Phone numbers
- Passport numbers
- Driver's licenses
- Government issued IDs
- Bank account numbers
- Photos
About This Breach
The investigation confirmed that sensitive files belonging to 10,920 applicants were compromised.
Exposed records included full names, dates of birth, 10-year residential address histories, passport scans and numbers, identity photographs and biometric identifiers, National Insurance numbers, and criminal conviction history disclosures.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
