DSG Retail Limited (Currys PC World)

DSG Retail Limited (Currys PC World) was fined the maximum penalty under the Data Protection Act 1998 following a cyberattack between July 2017 and April 2018 in which attackers installed malware on point-of-sale terminals across hundreds of UK stores, compromising the payment card data of an estimated 14 million customers. The ICO found DSG had inadequate patch management, no vulnerability scanning programme, and failed to detect the nine-month compromise through absence of basic security monitoring. The violations predated GDPR but the fine was the maximum available under the applicable DPA 1998 regime.