ICO issue fine of £4.4 to Interserve for security failings
On 24 October 2022, the ICO issued a penalty notice (MPN) to Interserve Group Limited (Interserve), imposing a fine of £4.4m for violations of the GDPR (the violations were pre-Brexit).
The ICO found that Interserve had failed to put appropriate technical and organisational measures in place to secure personal data (in contravention of Articles 5(1)(f) and 32 GDPR) for a period of ~20 months.
A phishing email with attached molicious document was sent to a group employee taht resulted in the installation of malware onto the workstation. This was flagged by Interserve’s end point protection system, which reported automatic removal of malware had been successful. Interserve took no further action to verify this, and the threat actor continued to have ongoing access to the workstation. Eventually attacker compromised four HR databases containing data of 113k employees and former employees. The databases were encrypted and rendered unavailable to Interserve.
Source: ICO issue fine of £4.4 to Interserve for security failings – Privacy Matters
