Bridewell analysis: human error behind over 26,000 UK data breaches reported to the ICO since 2020
Analysis by Bridewell of reports to the UK Information Commissioner's Office (ICO) found more than 26,000 data breaches caused by human error between 2020 and 2025. Annual human-error breaches rose from 3,847 to 5,496 (+43%). The leading cause is data emailed to the wrong recipient (11,214 incidents, up 62% from 1,519 in 2020 to 2,459 in 2025). Health is the most affected sector (5,054 incidents), followed by education and childcare (4,180) and local government (3,457). The article also notes a Ministry of Defence exposure of a spreadsheet with personal details of nearly 19,000 Afghan Relocations and Assistance Policy applicants. A DSIT study found 31% of UK businesses are not confident in storing or transferring personal data securely.
Detalhes técnicos
- Top five causes 2020-2025: data emailed to the wrong recipient (11,214), data posted or faxed to the wrong recipient (4,750), failure to redact (3,353), failure to use bcc (2,060), verbal disclosure of personal data (1,826).
- Exposed data included personal identifiers, criminal convictions or offences, health data and economic and financial data.
- Of 26,364 incidents with a recorded reporting time, 26% were reported in under 24 hours and 38% within 24-72 hours. 20% took 72 hours to a week and 17% took more than a week, so 36% missed the UK GDPR 72-hour deadline.
- Late or improper notification can lead to fines of up to £8.7 million or 2% of global annual turnover, whichever is higher.
- The MoD case stemmed from reliance on inappropriate tools, weak operating procedures, insufficient training and an inadequate data protection culture, per a Defence Committee report released in July.
Remediação
- Deploy technical controls: data loss prevention policies, recipient validation checks, encryption and "nudge" technologies.
- Run regular scenario-based training rather than only annual e-training.
- Simplify and automate data-handling processes.
- Maintain a well-tested incident response process and a no-blame reporting culture so incidents are reported within the 72-hour window.
Linha do tempo
-
Bridewell analysis: human error behind over 26,000 UK data breaches reported to the ICO since 2020
ler a análise desta fonte ocultar
Analysis by Bridewell of reports to the UK Information Commissioner's Office (ICO) found more than 26,000 data breaches caused by human error between 2020 and 2025. Annual human-error breaches rose from 3,847 to 5,496 (+43%). The leading cause is data emailed to the wrong recipient (11,214 incidents, up 62% from 1,519 in 2020 to 2,459 in 2025). Health is the most affected sector (5,054 incidents), followed by education and childcare (4,180) and local government (3,457). The article also notes a Ministry of Defence exposure of a spreadsheet with personal details of nearly 19,000 Afghan Relocations and Assistance Policy applicants. A DSIT study found 31% of UK businesses are not confident in storing or transferring personal data securely.
Technical Details
- Top five causes 2020-2025: data emailed to the wrong recipient (11,214), data posted or faxed to the wrong recipient (4,750), failure to redact (3,353), failure to use bcc (2,060), verbal disclosure of personal data (1,826).
- Exposed data included personal identifiers, criminal convictions or offences, health data and economic and financial data.
- Of 26,364 incidents with a recorded reporting time, 26% were reported in under 24 hours and 38% within 24-72 hours. 20% took 72 hours to a week and 17% took more than a week, so 36% missed the UK GDPR 72-hour deadline.
- Late or improper notification can lead to fines of up to £8.7 million or 2% of global annual turnover, whichever is higher.
- The MoD case stemmed from reliance on inappropriate tools, weak operating procedures, insufficient training and an inadequate data protection culture, per a Defence Committee report released in July.
Remediation
- Deploy technical controls: data loss prevention policies, recipient validation checks, encryption and "nudge" technologies.
- Run regular scenario-based training rather than only annual e-training.
- Simplify and automate data-handling processes.
- Maintain a well-tested incident response process and a no-blame reporting culture so incidents are reported within the 72-hour window.