How a Cyber Security Incident Led to a £3 million Penalty, and Over £21 million in Recovery Costs

Introduction On 26th March 2025, a penalty notice for over £3 million was released by the Information Commissioner’s Office (ICO). This followed an investigation of a security incident that started on 22nd August 2022, with final recovery actions taking place on 23rd May 2023 and impacted services such as NHS 111 and NHS Trusts. […]