HELLFIRE https://www.theregister.com/2025/04/16/law_firm_ico_fine/ A law firm is appealing against a £60,000 fine from the UK’s data watchdog after 32 GB of personal information was stolen from its systems. DPP Law Ltd, based in Merseyside, North West England, was attacked in June 2022. The Information Commissioner’s Office (ICO) says a third-party consultancy determined that the criminal used brute-force tactics to gain entry to an infrequently used administrator’s account that lacked multi-factor authentication. This was exploited to access a legacy case management system. The miscreant then moved laterally across DPP’s network and stole 32 GB of data, including private details about identifiable individuals, according to the ICO. DPP only became aware of the theft when the National Crime Agency contacted it to say information relating to its clients had been posted on the dark web, said the ICO, adding that DPP “did not consider the loss of access to personal information constituted a personal data breach” and didn’t report it to the ICO until “43 days after they became aware of it.” … Ignorantia juris non excusat Regards