UK's ACRO Criminal Records Office pulled portal offline after cyber incident

ACRO, the UK police body that manages criminal records information and issues police certificates for overseas visa and employment applications, confirmed on April 6, 2023 that a cyber security incident lay behind weeks of problems with its customer portal. The organisation said the incident ran from January 17 to March 21, 2023, and that it took the portal offline as soon as it was made aware on March 21.

For a period the ACRO website attributed the outage to essential maintenance or technical issues. The Register and The Record both reported that the agency acknowledged a security incident only after users had been left without a clear explanation for weeks. ACRO said the delay was because investigations were ongoing.

In emails to applicants, ACRO said that identification information and any criminal conviction data may have been affected. Details relating to nominated endorsers could also have been exposed, including their name, relationship to the applicant, occupation, phone number, email address and case reference number. The agency said there did not appear to be any potential risk to applicants' payment information, and added that it had no conclusive evidence that personal data had actually been accessed.

ACRO said it was working with the National Cyber Security Centre, which confirmed it was engaged with the organisation. The Information Commissioner's Office was notified and began making enquiries. With the portal down, applications had to be submitted by email and processed manually, and a backlog built up in the issuing of police certificates. ACRO did not disclose how many people it notified.