Cyber-Attack Prompts Charity Trustees To Reconsider Their Duties

The Information Commissioner's Office (the "ICO") announced last week that it was fining a religious charity, The British and Foreign Bible Society, £100,000 under the Data Protection Act 1998 (the "DPA")1. In 2016, the charity's computer network was compromised as a result of a cyber-attack. The ICO found that the attack was successful because the charity had failed to take measures to ensure that its computer network was adequately protected.

An easy-to-guess password allowed hackers to access a service account on the charity's internal network. Ransomware was deployed and the hackers secured access to the personal data of 417,000 of the Society's supporters. Some files were also transferred out of the network.

The ICO commented that the charity had exposed its supporters to possible financial or identity fraud as well as exposing the religious belief of its 417,000 supporters.

An organisation's responsibility to take measures to protect...