Advanced Ransomware Fine: Home Entry Details Exposed
The stolen records did not only contain names and numbers. For 890 people receiving care at home, they included details of how to get into their homes.
By Siddharth ShankarUpdated October 11, 2026On March 27, 2025, the UK Information Commissioner's Office fined Advanced Computer Software Group £3,076,320 over a 2022 ransomware attack that took the personal data of 79,404 people. It included details of how to enter the homes of 890 people receiving care. Hackers got in through a customer account without multi-factor authentication. See what to do after a breach.
Your email is the key to most of your accounts. Has it already leaked?
Free · About 30 seconds · No sign-up · Email not stored
Software suppliers sit behind many public services. When one is attacked, the effect can reach people who have never heard of it. The Advanced case is about a supplier of health and care software, and about a category of data that few people think of as personal until it is stolen: how to get into someone's home.
What happened
The ICO fined Advanced Computer Software Group Ltd £3,076,320, announced on March 27, 2025. The company accepted the fine through a voluntary settlement and did not appeal. The provisional fine in August 2024 had been £6.09 million. The attack took place in August 2022.
According to the ICO, the personal information of 79,404 people was taken. It included details of how to gain entry to the homes of 890 people receiving care at home.
How it worked
Hackers entered the systems of Advanced's health and care subsidiary through a customer account that lacked multi-factor authentication. The ICO identified gaps including incomplete MFA coverage, no comprehensive vulnerability scanning and inadequate patch management.
Multi-factor authentication adds a second step to a login, such as a code from an app. Without it, a stolen username and password can be enough.
What was exposed
The ICO release says the data taken included personal data for 79,404 people, and specifically access details for the homes of 890 people who receive care. Entry details of this kind, for example a code for a key safe, are meant to let carers in. In the wrong hands, it is a way into a home where a vulnerable person lives.
The release does not list other data categories, and we do not add any.
How it ended
For the company, the ending was a fine of about half the provisional figure after a voluntary settlement. For the people affected, the release does not describe any compensation. The ICO said it urged "all organisations to ensure that every external connection is secured with MFA today."
Quick check before you read on: is your email in a known data breach? Free, about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
A timeline of the case
The attack happened in August 2022. The ICO issued a provisional fine of £6.09 million in August 2024, two years later, and the final fine of £3,076,320 followed on March 27, 2025 after a voluntary settlement. The company did not appeal.
The halving of the fine reflects the settlement. The release lists the gaps the ICO identified: incomplete multi-factor authentication, no comprehensive vulnerability scanning and inadequate patch management.
Key facts at a glance
- Fine: £3,076,320, announced March 27, 2025
- Provisional fine: £6.09 million (August 2024)
- People affected: 79,404
- Home entry details: 890 people receiving care at home
- Attack: August 2022
- Entry point: a customer account without multi-factor authentication
Why this case matters
A breach of a supplier is a breach of its customers' customers. The people affected here were patients and care recipients who had no relationship with the software company.
It also shows how data that seems operational can be dangerous. Entry details are not sensitive in the way a diagnosis is, but their misuse could have physical consequences. Organizations that handle such details should limit who can see them and change them when they may have been exposed.
What you can do
1Ask your care provider how access codes are stored
Find out who can see them and whether they can be changed.
2Change door codes and key safes after any notice
A code that may be exposed should be replaced.
3Watch for suspicious callers
Someone who claims to be from a care service and knows your details should be checked through the official number. See how to tell if a breach notice is real.
4Keep any breach notice you receive
It documents what was exposed.
What the release does not say
The release does not say whether the home-entry details were misused or who carried out the attack. For a ransomware case that ended in a prison sentence, see the NetWalker case.
The practical next step is similar for most people. Read up on how data breaches happen, how to tell a real breach notice from a phishing message and what each type of breached data means, then review your own accounts. You can also try our free email exposure check.
Sources
- ICO: Software provider fined £3m following 2022 ransomware attack (£3,076,320 fine, 79,404 people, 890 home-entry details, £6.09m provisional fine)
Frequently asked questions
How much was Advanced fined?
The ICO fined Advanced Computer Software Group Ltd £3,076,320 on March 27, 2025, down from a provisional £6.09 million.
How many people were affected?
The personal information of 79,404 people was taken, including home entry details for 890 people receiving care.
How did the hackers get in?
Through a customer account that lacked multi-factor authentication, according to the ICO.
What should I do if my care provider was affected?
Change door codes or key safes, keep any notice, and check suspicious callers through official numbers.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Compare data removal services
See which services work in your country, what they cost, and the free do-it-yourself route.
Compare removal services →Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.