Why UK businesses are paying ICO millions for password mistakes you're probably making right now

Partner Content UK GDPR Article 32 mandates "appropriate security measures". The ICO has defined what that means: multi-million-pound fines for password failures. The violations that trigger them? Small, familiar, and happening in your organization right now. Your sysadmin shares SSH keys via WhatsApp in "defnotsshkeys.txt". Your HR manager stores employee ID scans in Gmail. Your intern has admin access because it was easier than configuring permissions. And your former contractor from 2017 still receives reports with client data because his email was never removed from the distribution list. These scenarios range from the simplest to more complex, like misconfigured cloud storage with cascading access rights across departments. But they share a common outcome: this is exactly how cybersecurity breaches happen. And when they do, ICO responds with fines that can cripple businesses. Capita plc just learned this expensive lesson — unsecured AWS buckets and extractable passwords cost them £14 million. The pattern continues across industries: Advanced Computer Software received a £3.07 million fine for incomplete MFA coverage. 23andMe paid £2.31 million after credential stuffing attacks exploited password reuse. Even small firms like DPP Law Ltd faced a £60,000 penalty when a brute-force attack breached an admin account that lacked MFA protection. The statutory maximum? Four percent of worldwide annual revenue. For a mid-sized UK business with £10 million turnover, that's a potent...