Software firm Advanced Computer Group Ltd has been fined £3.07 million by the ICO following a ransomware attack in which NHS data was stolen and systems were encrypted.
This is the first fine from the ICO for a data processor, highlighting the risks of not having robust security measures in place.
79,404 people's personal information was put at risk, including patient phone numbers, medical records, and access details for the homes of 890 people receiving care at home.
The ICO found that Advanced Computer Group Ltd lacked sufficient security measures, including comprehensive vulnerability scanning and adequate patch management.