The UK’s Criminal Records Office (ACRO) has confirmed it has been hit by a cyberattack, causing major delays and disruption to its services.
ACRO is the country’s national law enforcement organisation responsible for managing criminal record information, providing criminal records on request, and sharing those records with foreign nations.
Its website has been down since at least March 31, with a note displayed saying it is unavailable due to “technical issues”.
It means the applications for police certificates must be processed manually by email, causing delays.
There are also backlogs of visa applications waiting for criminal clearance.
The agency officially linked the website issues to a “cyber security incident” in a statement on Thursday, and said it was working with the National Cyber Security Centre to investigate the matter.
According to an email sent to affected users this week, the service experienced the attack for two months, between January 17 and March 21.
The statement reads: “ACRO Criminal Records Office has experienced a cyber security incident, the impact of which is primarily causing delays to the issuing of Police Certificates.
“As soon as we were made aware on 21st March of the incident, we took robust action to take the application portal offline so we could fully investigate. We have emailed all applicants who may have been affected.
“We are working with the relevant authorities, including the National Cyber Security Centre, to investigate and remediate the incident. There is currently no conclusive evidence that personal data has been affected.
“Our services to policing and other agencies, along with our criminal record exchanges with overseas countries, are still operational.”
The Information Commissioner’s Office, which is the UK’s data watchdog, said it was aware and that it was “making enquiries”.
