Almost one-third of data breaches reported to ICO came from outsiders

Concept art showing locked packlocks with one opened coloured in red, signifying a data breach
(Image credit: Getty Images)

Nearly one-third of security decision makers in the UK claim they have been reported to the Information Commissioner’s Office (ICO) over a data breach by an individual outside their organization. 

Analysis from Manchester-based encryption firm, Apricorn, recorded a steep increase in the number of organizations reported to the ICO so far during 2023, with 32% reported by someone outside their firm. 

The increase marks a significant rise compared to previous years. In 2022, just 4% of breaches were reported to the watchdog by outsiders while in 2021 this stood at 10%. 

This, the firm said, suggests a growing public appetite to hold businesses to account over potential data security risks. 

“This could be a sign of increased awareness as people become more au fait with the signs of a data breach and the importance of reporting them, but it could also indicate a lack of internal awareness or due process,” the company said. 

Jon Fielding, managing director for EMEA at Apricorn said the trend raises additional questions over internal reporting practices in the event of a data breach or potential risks to consumers. 

“Not all breaches are reportable, but likely recordable. The fact these breaches have been reported from outside the organization may indicate that internal teams are not as aware as they should be of transgressions,” he said.

Research earlier this year found that nearly half of cyber security practitioners have been told to keep data breaches “under wraps” by senior management.  

The study from Bitdefender revealed that 42% had been told to keep a data breach confidential when they knew it should have been reported


Whitepaper from BT on how to embed a cybersecurity culture, with image of a businessman looking out of an office in a high-rise building

(Image credit: BT)

Discover how you can prepare and protect your organization from a cyber attack.


US-based security practitioners were found to be the most likely to have kept a breach hidden, with 71% failing to inform senior management or customers. UK and European-based respondents were typically more likely to report data breaches and security incidents, however. 

The repercussions for failing to disclose a data breach can be costly for organizations and individuals on both sides of the Atlantic. EU-based firms are required to notify authorities “without undue delays” and within 72 hours upon discovery of a breach. 

Internal reporting still prioritized 

Apricorn’s report said that despite an increase in external reporting, internal data breach disclosures are still prioritized by security leaders. 

Nearly half (40%) of respondents said breaches or potential breaches were reported to the ICO by someone within their organization. 

The study suggested this highlights a continued awareness on the importance of data breach disclosures and “speedy remediation” when complying with regulations such as GDPR

Ross Kelly
News and Analysis Editor

Ross Kelly is ITPro's News & Analysis Editor, responsible for leading the brand's news output and in-depth reporting on the latest stories from across the business technology landscape. Ross was previously a Staff Writer, during which time he developed a keen interest in cyber security, business leadership, and emerging technologies.

He graduated from Edinburgh Napier University in 2016 with a BA (Hons) in Journalism, and joined ITPro in 2022 after four years working in technology conference research.

For news pitches, you can contact Ross at, or on Twitter and LinkedIn.