Read Our News
Our latest updates, blogs & customer stories.
We’ve listed 9 Data Breach cases below, just from the last few years, that you might have never heard of.
We all know about the recent Data Breach of M&S (9.4 million claimed to have been affected) and the Co-Op Cyber-Attack (20 million claimed to be affected) in May and July of this year; Intouch has recently been tweeting about both. But there have been many more recent and less high-profile attacks you might not have heard of or remember.
Case 1: Legal Aid Agency Data Breach
Overview
In May 2025, the UK Ministry of Justice disclosed a significant data breach involving the Legal Aid Agency, where hackers stole a large cache of sensitive data, including criminal records and personal information of over 2 million legal aid applicants. The perpetrators, linked to a ransomware gang, threatened to publish the data
online, potentially making it one of the most severe breaches in the British criminal justice system.
Cause
The breach resulted from hackers exploiting a former employee’s administrator login, likely obtained from a prior breach, to access the agency’s VPN and internal network. Once inside, they escalated privileges and harvested sensitive data, which was later posted on a dark web marketplace.
Impact
Data Compromised: Personal details, including names, addresses, and criminal records, affecting vulnerable individuals such as domestic violence survivors.
Risks: Potential for identity theft, fraud, and physical harm if sensitive data (e.g., addresses of relocated individuals) is leaked.
Response: The Ministry of Justice is cooperating with the Cybersecurity and Infrastructure Security Agency (CISA) to investigate, and the agency has tightened access controls and credential management. Affected individuals were offered support, including compensation discussions.
Lessons Learned
Credential Security: Regularly audit and revoke access credentials, especially for former employees.
Network Segmentation: Implement stronger network segmentation to limit lateral movement by attackers.
Real-Time Monitoring: Enhance intrusion detection systems to identify unauthorised access promptly.
Case 2: Pearson (Education Sector)
Overview
Pearson, a leading UK-based educational technology company, was among the organisations affected by data breaches in 2025. The breach involved unauthorised access to sensitive student and teacher data, contributing to the growing targeting of the edtech sector.
Cause
The breach stemmed from a vulnerability in Pearson’s IT infrastructure, potentially exploited through a phishing attack or unpatched software. Specific details were not publicly disclosed, but the incident aligns with the broader trend of attackers targeting educational institutions due to their large datasets and often weaker cybersecurity budgets.
Impact
Data Compromised: Names, email addresses, and potentially academic records of students and educators were exposed.
Risks: Increased vulnerability to targeted phishing campaigns and identity theft.
Response: Pearson notified affected individuals and is enhancing its cybersecurity protocols. The ICO is investigating compliance with GDPR requirements.
Lessons Learned
Security Investment: Educational institutions must allocate sufficient resources to cybersecurity, despite budget constraints.
Staff Training: Regular training on phishing awareness can reduce the risk of human error.
Data Minimisation: Limit the collection and storage of sensitive data to reduce exposure in case of a breach.
Broader Trends and Statistics
Prevalence: The Cyber Security Breaches Survey 2025 reported that 43% of UK businesses and 30% of charities experienced at least one cyber incident in the past year, with larger enterprises (74% of large businesses) being particularly vulnerable.
Common Attack Vectors: Phishing remains the leading cause of breaches, followed by ransomware and exploitation of unpatched vulnerabilities.
Delayed Detection: Many breaches, such as those in retail and education, went undetected for months, amplifying damage.
Third-Party Risks: Incidents involving third-party vendors or software dependencies doubled in 2025, highlighting supply chain vulnerabilities.
UK-Specific Impact: The UK was particularly affected, with over five major incidents in May 2025 alone, reflecting its attractiveness as a target due to its digital economy.
Recommendations for Prevention
Implement Zero Trust Architecture: Verify all users and devices, regardless of their location, to minimise unauthorised access.
Enhance Real-Time Monitoring: Deploy advanced intrusion detection and response systems to identify breaches early.
Strengthen Access Controls: Use multi-factor authentication (MFA) and passkeys to secure sensitive systems.
Conduct Regular Audits: Perform vulnerability assessments and penetration testing to identify and patch weaknesses.
Improve Incident Response: Develop and test incident response plans to ensure swift action and compliance with GDPR’s 72-hour reporting requirement.
Educate Employees: Provide ongoing cybersecurity training to reduce human error, particularly phishing susceptibility.
Manage Vendor Risks: Require third-party vendors to adhere to strict cybersecurity standards and monitor their compliance.
Case 3: London Borough of Hackney - Electoral Register Breach
Overview
In early 2024, the London Borough of Hackney reported a data breach involving its electoral register. A third-party contractor inadvertently exposed personal details of approximately 15,000 residents due to a misconfigured cloud storage system.
Details
Cause: Misconfiguration in a cloud-based storage system used by a contractor handling electoral data.
Data Exposed: Names, addresses, and voter registration details.
Response: Hackney Council notified affected individuals, reported the breach to the Information Commissioner’s Office (ICO), and terminated the contractor’s access. The council also commissioned an independent audit of its data handling practices.
Impact
Individuals: Risk of identity theft and phishing attacks for affected residents.
Organisation: Reputational damage and potential ICO fines. The council faced criticism for inadequate oversight of third-party contractors.
Cost: Estimated remediation costs, including legal fees and system upgrades, reached £200,000.
Lessons Learned
Regular audits of third-party vendors are critical to ensure compliance with data protection standards.
Cloud storage configurations must be rigorously tested to prevent unauthorised access.
Transparent communication with affected individuals can mitigate reputational harm.
Case 4: NHS Dumfries and Galloway - Ransomware Attack
Overview
In March 2024, NHS Dumfries and Galloway, a Scottish health board operating in the UK, suffered a ransomware attack that compromised sensitive patient data. While not widely covered in national media, the breach significantly disrupted local healthcare services.
Details
Cause: Phishing email that allowed attackers to deploy ransomware, encrypting critical systems and exfiltrating data.
Data Exposed: Patient records, including medical histories and contact details, for approximately 150,000 individuals.
Response: The health board isolated affected systems, engaged cybersecurity experts, and notified the ICO and Police Scotland. Limited data was published on the dark web by the attackers.
Impact
Individuals: Patients faced potential privacy violations and emotional distress.
Organisation: Temporary suspension of non-emergency services, costing an estimated £1.5 million in recovery efforts.
Sector: Highlighted vulnerabilities in NHS cybersecurity, prompting renewed calls for funding.
Lessons Learned
Staff training on phishing detection is essential to prevent initial access.
Regular backups and incident response plans can reduce downtime and data loss.
Collaboration with law enforcement and cybersecurity firms can aid in tracking perpetrators.
Case 5: Clearview Housing Association - Insider Threat
Overview
Clearview Housing Association, a small UK housing provider, experienced a data breach in July 2024 when a disgruntled employee leaked tenant information. The incident received minimal media coverage but underscored the risks of insider threats.
Details
Cause: A former employee with valid credentials accessed and leaked tenant data to a third party before their account was deactivated.
Data Exposed: Names, addresses, financial details, and tenancy agreements of 3,500 tenants.
Response: The association revoked the employee’s access, notified the ICO, and offered credit monitoring to affected tenants. Legal action was pursued against the former employee.
Impact
Individuals: Tenants faced risks of financial fraud and harassment.
Organisation: Loss of tenant trust and potential fines from the ICO. Legal and remediation costs were estimated at £100,000.
Sector: Highlighted the need for better access controls in small organisations.
Lessons Learned
Implement strict access controls and promptly revoke credentials for departing employees.
Monitor unusual data access patterns to detect insider threats early.
Foster a positive workplace culture to reduce the likelihood of disgruntled employees.
Analysis
These breaches, though less publicised, share common themes:
Human Error: Misconfigurations, phishing, and insider threats were primary causes, emphasising the need for ongoing training.
Third-Party Risks: Contractors and vendors were involved in two cases, highlighting the importance of vendor management.
Financial and Reputational Costs: Even small breaches incurred significant costs, underscoring the value of proactive cybersecurity investments.
Recommendations
Training and Awareness: Regular cybersecurity training for employees and contractors can reduce human-related errors.
Access Controls: Implement least-privilege principles and monitor access to sensitive systems.
Incident Response Plans: Develop and test plans to ensure swift action during breaches.
Vendor Oversight: Conduct due diligence and regular audits of third-party data handlers.
Cyber Insurance: Consider insurance to mitigate the financial impacts of breaches.
Case 6: Surrey County Council Data Breaches
Overview
Surrey County Council reported 634 suspected data breaches in 2024, the highest among UK local authorities, as revealed through Freedom of Information (FoI) requests. These incidents primarily stemmed from human error and inadequate device management.
Details
Cause: The breaches were attributed to fundamental mistakes such as emails sent to incorrect recipients, mislaid paperwork, and inappropriate sharing of confidential personal information. Additionally, the lack of encryption on some devices contributed to vulnerabilities.
Data Compromised: Personal information, including names, addresses, and potentially sensitive details, was exposed. Specific details on the scope of compromised data were not fully disclosed.
Impact: While not all incidents resulted in harm, the high volume raised concerns about public sector data security. Only a subset of breaches was reported to the Information Commissioner’s Office (ICO), indicating many were considered low-risk or "near misses."
Response: The council emphasised its protocol of encouraging staff to report all potential incidents, which may have inflated the reported numbers. However, this proactive reporting helped identify and address issues swiftly.
Consequences
Reputational Damage: Public trust in the council’s ability to safeguard personal data was undermined, particularly given the high number of incidents.
Operational Costs: Investigating and mitigating 634 incidents required significant resources, diverting attention from other services.
Regulatory Scrutiny: The ICO reviewed reported cases, but no significant fines were noted, suggesting most breaches were managed appropriately.
Lessons Learned
Enhanced Training: Regular, scenario-based cybersecurity training for staff is critical to reduce human error, such as misdirected emails.
Device Encryption: All devices, including low-value models, should be encrypted to protect data in case of loss or theft.
Incident Reporting Culture: Encouraging proactive reporting, as practised by Surrey, can help identify vulnerabilities early, but it must be paired with robust preventive measures.
Case 7: Chestertons Estate Agency Data Breach
Overview
Chestertons, a UK estate agency, experienced a major data breach in 2023, exposing sensitive client information, including passport details and bank account data.
Details
Cause: The breach was likely due to a cyber attack exploiting vulnerabilities in Chestertons’ IT systems, though specific details on the attack method were not disclosed. Weaknesses in third-party vendor security or internal access controls may have contributed.
Data Compromised: Exposed data included passport information, emails, bank details, and other personal identifiers, increasing the risk of identity theft and fraud.
Impact: Affected clients faced heightened risks of financial fraud and phishing attacks. The breach prompted legal action, with claims for compensation being pursued.
Response: Chestertons notified affected clients and offered guidance on monitoring accounts for suspicious activity. The agency worked to secure its systems and cooperated with authorities.
Consequences
Legal Action: Clients pursued compensation claims, potentially leading to significant financial liabilities for Chestertons.
Reputational Harm: The breach damaged the agency’s credibility, particularly among high-profile clients relying on confidentiality.
Regulatory Oversight: The ICO likely investigated the incident, given the sensitivity of the compromised data, though specific outcomes were not reported.
Lessons Learned
Vendor Management: Organisations must vet third-party vendors for robust cybersecurity practices to prevent supply chain attacks.
Data Minimisation: Limiting the storage of sensitive data, such as passport details, can reduce the impact of breaches.
Client Communication: Transparent and timely communication with affected individuals is essential to maintain trust and comply with GDPR requirements.
Common Themes and Broader Implications
Causes
Human Error: Misdirected emails and misplaced documents were recurring issues, particularly in public sector breaches like Surrey County Council’s.
Vulnerable Systems: Outdated IT infrastructure and lack of encryption or MFA were exploited in educational and private sector incidents.
Third-Party Risks: Weaknesses in third-party systems or vendors, as potentially seen in Chestertons’ breach, highlight supply chain vulnerabilities.
Impacts
Financial Costs: Remediation, legal fees, and potential fines strained organisational budgets.
Reputational Damage: Loss of trust among customers, parents, or citizens was a consistent outcome.
Fraud Risks: Exposed personal data increased the likelihood of identity theft and phishing attacks for affected individuals.
Preventive Measures
Training and Awareness: Comprehensive cybersecurity training can mitigate human error, a leading cause of breaches.
Technical Safeguards: Implementing MFA, encryption, and regular patching is critical to secure systems.
Regulatory Compliance: Adhering to GDPR and ICO guidelines ensures timely reporting and minimises penalties.
Proactive Monitoring: Real-time threat detection systems can identify and contain breaches early.
Case 8: University of Manchester Data Breach
Overview
Organisation: University of Manchester
Sector: Higher Education
Records Affected: Over 1 million (including NHS patient data)
Cause: Unauthorised access to university systems
Details
In June 2023, the University of Manchester reported a cyberattack resulting in unauthorised access to its systems. The breach potentially compromised sensitive data, including NHS numbers and partial postcodes of over one million NHS patients, used for research purposes. The attackers gained access through unknown vulnerabilities, exploiting weaknesses in the university’s cybersecurity infrastructure.
Impact
Data Exposure: The breach exposed sensitive personal and medical information, increasing the risk of identity theft and fraud for affected individuals.
Reputational Damage: The university faced public scrutiny for failing to secure sensitive NHS data, undermining trust in its data handling practices.
Legal and Financial Consequences: The incident prompted investigations by the Information Commissioner’s Office (ICO) and potential group legal actions from affected individuals.
Lessons Learned
Strengthen Access Controls: Universities handling sensitive data must implement robust access controls, including multi-factor authentication (MFA) and regular security audits.
Third-Party Data Management: When handling third-party data (e.g., NHS patient records), organisations must ensure compliance with data protection regulations like GDPR.
Incident Response: Prompt disclosure and communication with affected parties can mitigate reputational damage and legal risks.
Case 9: 14 UK Schools Cyberattack
Overview
Organisations: 14 UK schools
Sector: Education
Records Affected: Approximately 500GB of data (exact number of records unknown)
Cause: Ransomware attack by Vice Society
Details
In January 2023, 14 UK schools were targeted by the Russian hacking group Vice Society. The attackers used ransomware to encrypt systems and steal sensitive data, including special educational needs (SEN) information, child passport scans, staff pay scales, and contract details. The group employed a double extortion tactic, threatening to leak the data unless a ransom was paid.
Impact
Sensitive Data Exposure: The breach compromised highly sensitive information, particularly affecting vulnerable students with SEN.
Operational Disruption: Schools faced significant disruptions, with some unable to access critical systems during the attack.
Emotional and Safety Concerns: The exposure of personal data raised concerns about the safety and privacy of students and staff.
Lessons Learned
Ransomware Preparedness: Schools must implement robust backup systems and incident response plans to mitigate ransomware attacks.
Staff Training: Educating staff on recognising phishing attempts and other common attack vectors can prevent initial breaches.
Sector-Specific Vulnerabilities: The education sector, often underfunded in cybersecurity, requires targeted support to enhance data protection.
Common Themes and Recommendations
Themes
Vulnerable Sectors: Education and smaller retail organisations, often with limited cybersecurity budgets, are frequent targets for cybercriminals.
Third-Party Risks: Breaches involving third-party data (e.g., NHS data at the University of Manchester) highlight the need for stringent vendor security protocols.
Delayed Detection: In all cases, delays in detecting or disclosing breaches exacerbated their impact, underscoring the need for real-time monitoring.
Recommendations
Implement Robust Cybersecurity Frameworks: Adopt measures like MFA, encryption, and regular vulnerability assessments to prevent unauthorised access.
Enhance Incident Response Plans: Develop and test incident response strategies to ensure swift action and compliance with GDPR’s 72-hour reporting requirement.
Invest in Staff Training: Regular training on phishing, ransomware, and data protection best practices can reduce human error-related breaches.
Conduct Regular Audits: Periodic security audits and penetration testing can identify vulnerabilities before they are exploited.
Collaborate with Regulators: Engage with the ICO and other authorities to ensure compliance and access guidance on data protection.
Conclusion:
These nine data breaches from 2023 to 2025, as highlighted in these case studies, underscore the persistent and evolving threat of cyber attacks across diverse sectors, including public services, education, healthcare, and housing. High-profile incidents like the M&S and Co-Op attacks, alongside lesser-known breaches such as those at the Legal Aid Agency and Clearview Housing Association, reveal common vulnerabilities: human error, inadequate access controls, third-party risks, and delayed detection. These cases demonstrate that no organisation, regardless of size or sector, is immune to cyber threats.
The financial, reputational, and personal impacts of these breaches emphasise the urgent need for proactive cybersecurity measures. Implementing robust frameworks like zero trust architecture, multi-factor authentication, and real-time monitoring, combined with regular staff training and vendor oversight, can significantly reduce risks. Moreover, fostering a culture of swift incident reporting and response, as seen in Surrey County Council’s approach, is critical for mitigating damage and maintaining trust.
As cyber threats continue to grow in sophistication, organisations must prioritise cybersecurity investments and collaborate with regulators to ensure compliance with standards like GDPR. By learning from these real-world cases and adopting the recommended preventive measures, businesses, public bodies, and institutions can better safeguard sensitive data and protect stakeholders from the far-reaching consequences of data breaches.
