UK outsourcer Interserve fined £4.4 million for litany of data protection failings
The numerous security blunders allowed cyber attackers to comprise its systems, install malware, and access the personal data of 113,000 of its staff


UK outsourcing firm Interserve has been fined £4.4 million for data protection failings that resulted in the company suffering a significant cyber attack in 2020.
The Information Commissioner’s Office (ICO) issued the fine on Monday morning citing a lengthy period in which Interserve failed to adequately secure the personal data of its own staff.
Interserve’s issues were investigated between 18 March 2019 and 1 December 2020 and were related to a cyber attack that took place on 30 March of that year.
The attack led to the compromise of personal information belonging to 113,000 employees including special category data such as sexual orientation, disability, and religion.
Interserve said there was no evidence of data exfiltration - a statement with which the ICO concurred, but the data watchdog added that the possibility could not be ruled out.
A deadline of 21 November 2022 has been set by the ICO to pay the fine in full but this would be extended if Interserve appealed the fine, which it can do at any point 28 days following the fine’s issuance.
The company was found guilty of numerous security failings, including its reliance on out-of-date infrastructure to host its HR system, iTrent - which processed a large volume of personal data.
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
The ICO’s investigation revealed that Interserve was processing personal data on 40 servers running Microsoft Server versions (2003 R2 and 2008 R2) that were either no longer officially supported or had already gone end of life (EOL).
RELATED RESOURCE
Data governance and privacy for data leaders
Create your ideal governance and privacy solution
“Interserve ought reasonably to have been aware of the risks posed by running outdated support systems, in particular in circumstances where the risks of running outdated support systems were well-known and documented,” read the ICO’s penalty notice.
It also pointed to how Microsoft publicly alerted customers to the increased targeting of vulnerable and outdated systems with ransomware during this period, and that Interserve's IT team should have been aware of and acted on the company’s legacy IT issues.
“Further, Interserve failed to undertake any formal risk assessments in relation to using unsupported operating systems on its data processing servers,” the ICO added.
Interserve was also using a version of McAfee VirusScan Enterprise that wasn’t running the latest version, leading the ICO to confirm the company failed to implement adequate endpoint protection.
The penalty notice additionally included a litany of other security failings such as failure to conduct penetration tests and issue cyber security training to staff, a slow incident response, and more.
Interserve told IT Pro that it "strongly disputes" the ICO's claims that its staff and incident response were "in any way complacent" and that the watchdog's statements were "inconsistent" with its penalty notice.
"Notwithstanding the inconsistencies between the ICO’s penalty notice and press release, and concerns that the ICO has not followed a fair and proper process, Interserve will continue to prioritise the interests of its past and present staff, counterparties, and other stakeholders while engaging with the ICO to resolve their investigations," a spokesperson said.
What happened in the Interserve cyber attack?
Employees at the company were targeted with phishing emails on 30 March 2020 and malware was installed via a ZIP file attachment.
Two employees were implicated in the incident and the ICO said one of them had not received cyber security training.
The initial recipient of the email on 30 March 2022 then forwarded it to another employee in the company who was tasked with paying invoices.
The malware was installed on the victim’s machine, who was working from home at the time, and allowed access to the company’s sensitive information through split tunnelling which facilitated the access of data while encrypting internet traffic.
Attackers made initial access on 3 April 2020 and continued to access Interserve’s systems until May of that year when they used tools to compromise 283 systems and 16 accounts, 12 of which were privileged, across four domains, the ICO said.
The attackers were able to access the data and encrypt it, rendering it inaccessible to Interserve.
Interverse only became aware of the incident on 2 May 2020 after it spotted a message that it had been hacked that had embedded in its server infrastructure.
The incident was later revealed as ransomware and outside experts were called in to remediate the situation after it was reported to the NCSC and ICO.

Connor Jones has been at the forefront of global cyber security news coverage for the past few years, breaking developments on major stories such as LockBit’s ransomware attack on Royal Mail International, and many others. He has also made sporadic appearances on the ITPro Podcast discussing topics from home desk setups all the way to hacking systems using prosthetic limbs. He has a master’s degree in Magazine Journalism from the University of Sheffield, and has previously written for the likes of Red Bull Esports and UNILAD tech during his career that started in 2015.
-
Ransomware attacks are rising — but quiet payouts could mean there's more than actually reported
News Ransomware attacks continue to climb, but they may be even higher than official figures show as companies choose to quietly pay to make such incidents go away.
By Nicole Kobie
-
Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the last
News Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
By Ross Kelly
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackers
News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
By Emma Woollacott
-
Healthcare systems are rife with exploits — and ransomware gangs have noticed
News Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
By Nicole Kobie
-
Alleged LockBit developer extradited to the US
News A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
By Emma Woollacott
-
February was the worst month on record for ransomware attacks – and one threat group had a field day
News February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
By Emma Woollacott
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impacted
News The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
By Solomon Klappholz
-
Warning issued over prolific 'Ghost' ransomware group
News The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
By Solomon Klappholz