Interserve Group Limited

Interserve Group, a major UK government contractor, was fined for a 2020 phishing attack that compromised personal and special category data of up to 113,000 current and former employees, including health, financial, and immigration status information. The ICO found Interserve had failed to implement adequate anti-phishing controls, failed to follow its own security processes for flagging suspicious emails, had outdated and unpatched software across its systems, and provided insufficient staff security training. The company was also required to implement a formal remediation programme.