Advanced: one customer account exposed care information

What was reported

The ICO reported that attackers entered systems at Advanced’s health and care subsidiary through a customer account without multi-factor authentication. Information about 79,404 people was taken, including instructions for entering the homes of 890 care recipients. The regulator’s final penalty was £3.07 million, following a voluntary settlement.

Read the report from Information Commissioner’s Office

Our perspective

Our reading: Care information needs boundaries within a supplier’s systems as well as at the login screen. A task-specific extract should expose only the details that the particular care task requires.

Limits of this connection

This was a ransomware incident, not an AI incident. Authentication, patching and supplier security remain essential; a memory layer cannot replace them.