INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Met Fined by ICO Over Third-Party Data Security Breach

| 2026-10-15 08:30 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
The UK's data protection regulator, the Information Commissioner’s Office (ICO), has issued a reprimand and enforcement notice to Metropolitan Police Service (MPS) over governance failings related to its use of third-party platform Auror retail crime intelligence-sharing. The ICO found that between March 2023 and September 2024, MPS officers and staff used the platform despite it not being formally approved, resulting in the unauthorized upload of personal information including names, dates of birth, and home addresses relating to 179 people - three of whom were under 18. Auror's "Connect the Dots" module was found to be used for image matching and manual suggestions to identify links between events and individuals, but not properly vetted by MPS cybersecurity team. The ICO identified four infringements related to unlawful processing of personal information without consent, failure to implement proper safeguards, lack of data protection impact assessment, and continued use of unapproved third-party technology.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
FIVE_EYES FIVE_EYES retailretail
Incident Timeline
‎between March 2023
MPS officers and staff used a third-party data leak platform between March 2023 and September 2024 without formal approval.
‎September 2024
Threat actors used a third-party data leak to create and use 500 MPS accounts, with some being active between March 2023 and September 2024.
organisation CCTV
In the first, an officer uploaded the full names of suspects they recognized in CCTV images shared by a retailer.
‎between January and September 2024
Threat actors uploaded personal information of 179 people, including names, dates of birth and home addresses, to an unvetted platform between January and September 2024.
organisation ICO
However, the ICO said that between January and September 2024 personal information including names, dates of birth and home addresses relating to 179 people – three of whom were under 18 – was uploaded to the unvetted platform.
general_metric 179 people
However, the ICO said that between January and September 2024 personal information including names, dates of birth and home addresses relating to 179 people – three of whom were under 18 – was uploaded to the unvetted platform.
‎2026/10/15
The UK's data protection regulator, the Information Commissioner’s Office (ICO), issued a reprimand and enforcement notice to Metropolitan Police Service (MPS) over governance failings related to its use of the Auror retail crime intelligence-sharing platform.
organisation ICO Reprimands Met Over
ICO Reprimands Met Over Third-Party Data Leak.
organisation the Information Commissioner’s Office
The investigation by the Information Commissioner’s Office (ICO) was focused on Metropolitan Police Service (MPS) use of the Auror retail crime intelligence-sharing platform, which it used in a crackdown on shoplifting.
organisation MPS
The investigation by the Information Commissioner’s Office (ICO) was focused on Metropolitan Police Service (MPS) use of the Auror retail crime intelligence-sharing platform, which it used in a crackdown on shoplifting.
organisation DPIA
…organizational measures” to protect personal information and follow proper assessment and approval processes for third-party technologies Failed to complete a data protection impact assessment (DPIA) before undertaking high-risk processing Continues to fail to implement appropriate measures to ensure only approved third-party technologies are used to process personal information…
Intelligence Sources
Infosecurity-Magazine 2026-10-15