UK Fines Law Firm 60,000 Pounds for Ransomware Data Breach

The U.K. Information Commissioner’s Office imposed a fine of 60,000 pounds against Liverpool-based law firm DDP Law for GDPR violations relating to a 2022 ransomware hack and data leak that exposed sensitive information including the details of its clients’ cases.

See Also: Top 10 Technical Predictions for 2025

The Information Commissioner’s Office on Wednesday said the law firm violated the U.K. General Data Protection Regulation by failing to adequately protect customer data or eliminate data breach risks.

“Our investigation revealed lapses in DPP’s security practices that left information vulnerable to unauthorized access,” said Andy Curry, ICO’s interim director of enforcement and investigations.

Hackers in a 2022 ransomware attack stole 32.4 gigabytes of data from the law firm and later posted on the darkweb. The breach affected 791 people and contained information about 306 clients including DNA testing data, details on children and victims of sexual offenses.

The ICO investigation identified several security and privacy missteps that led to the data breach including the law firm using an outdated account with high privileges, failing to assess risks posed by its IT systems and waiting 43 days to notify the ICO after of becoming aware of the incident. Under GDPR, organizations are required to report breaches within 72 hours.

The ICO also pointed out that the law firm only found out about the breach from the National Crime Agency, which contacted the firm about the leaked data on the darkweb.

“Data protection is not optional. It is a legal obligation, and this penalty should serve as a clear message: Failure to protect the information people entrust to you carries serious monetary and reputational consequences,” Curry said.

The hackers compromised DPP Law after hacking an end-user device and later pivoted to a DPP administrator SQLuser account that did not have multifactor authentication protection. The hackers then used a remote desktop machine to access the case management systems./

A day after the incident, DPP’s firewall failed to detect any suspicious activity. But analysis by the ICO found the SQLuser account was still running on the company’s network, even though the service provider retired the application in 2019.

Further, DPP did not have access to this account, and it failed to conduct any assessments to understand the risks posed by the system, the ICO said.

“DPP’s failure to implement these measures constituted a failure to implement appropriate technical and organizational measures to ensure an appropriate level of security over the personal data it was processing,” the ICO said.

DPP Law can appeal the fine. The firm did not immediately respond to a request for comment from Information Security Media Group.