What happened, who was affected, and what we can learn…
January started the year with a familiar lesson; some of the most serious data breaches still come down to basic failures, rather than sophisticated cyberattacks.
January 2026 opened with a clear regulatory message; the ICO is placing greater weight on accountability, governance and how organisations handle highly sensitive personal data; not just whether a breach happened, but whether it should have been preventable in the first place.
This month’s incidents ranged from the continued fallout of large-scale credential compromise to failures involving identity records and organisational disclosure controls. While some cases involved direct cyber intrusion, others were caused by weak internal processes and poor data stewardship—issues that remain just as damaging.
With the Data (Use and Access) Act 2025 now shaping enforcement expectations more visibly, organisations are facing a much less forgiving regulatory environment. January’s cases show that both historic failures and newly identified weaknesses can still lead to serious scrutiny.
As always, this report brings together ICO enforcement activity, public disclosures, and credible reporting involving breaches affecting people in the UK.
Only incidents involving UK individuals and confirmed ICO oversight are included.
23andMe
Date Reported: January 2026 (ongoing regulatory impact following enforcement action)
No. of UK Individuals Affected: 155,592
Data Exposed or at Risk: Genetic information, ancestry reports, family tree connections and health-related profile data.
ICO Response: £2.31 million monetary penalty upheld following serious UK GDPR failings linked to credential-stuffing attack.
Summary: The consequences of the 23andMe breach continued into 2026 as the ICO’s enforcement remained one of the clearest examples of regulatory action involving highly sensitive personal data. Attackers had used previously stolen credentials to gain access to user accounts and harvest deeply personal genetic and ancestry information.
Commentary: This case remains one of the strongest reminders that sensitive data must mean stronger security by default. DNA data cannot be reset like a password. Optional MFA and delayed response were never defensible here and the regulatory outcome reflects exactly how seriously this should be treated.
Post Office (Horizon Settlement Document Exposure)
Date Reported: January 2026 (continued fallout following ICO reprimand)
No. of UK Individuals Affected: 502
Data Exposed or at Risk: Names, home addresses and postmaster status of individuals involved in Horizon litigation.
ICO Response: Public reprimand remained in force; continued scrutiny of disclosure controls and publishing processes.
Summary: An unredacted legal settlement document involving Horizon postmasters had previously been uploaded to the Post Office website and remained accessible publicly. The exposure continued to draw criticism due to the vulnerability of the affected group and the preventable nature of the mistake.
Commentary: This was not a cyberattack; it was a basic publishing failure. But for the individuals involved, especially given the wider Horizon scandal, the damage was personal and serious. It showed a failure of care more than a failure of technology and those are often the hardest to justify.
NHS Supplier/Third-Party System Exposure
Date Reported: January 2026
No. of UK Individuals Affected: Undisclosed
Data Exposed or at Risk: Staff and service-user information linked to third-party hosted systems.
ICO Response: Incident reported to the ICO; assessment ongoing, no public enforcement outcome announced.
Summary: Multiple healthcare-adjacent suppliers and outsourced platforms continued to report security incidents involving hosted systems and operational service providers. While not all resulted in immediate public enforcement, January reinforced ongoing concern around third-party exposure in healthcare environments.
Commentary: Healthcare breaches often begin far away from the hospital itself. Suppliers, hosted systems, payroll processors and support platforms all create risk. If a supplier can compromise patient or staff data, then supplier assurance is not procurement admin; it is frontline risk management.
Insights for UK Organisations
- Historic breaches do not disappear; enforcement action can continue months or years after the original incident, especially where sensitive data is involved.
- Publishing and disclosure failures remain common; the Post Office case proves that simple redaction failures can carry major regulatory and reputational consequences.
- Third-party risk continues to grow and many organisations still underestimate how much of their real exposure sits with suppliers rather than internal systems.
- Regulators are focusing more on governance, not just breach response; what mattered increasingly in January was whether organisations had reasonable preventative controls in place.
Legislative Context
January 2026 sits within the early practical impact of the Data (Use and Access) Act 2025, which strengthened several areas of regulatory oversight and compliance expectations.
The ICO’s approach increasingly reflects:
- Stronger accountability requirements.
- More formal breach logging and reporting expectations.
- Clearer expectations around complaint handling and lawful basis decisions.
- Greater scrutiny of organisational decision-making before an incident occurs.
The message is shifting from “tell us when something goes wrong” to “prove you were managing the risk properly before it did”.
This is especially important for organisations handling:
- Special category data.
- Public-sector records.
- Health and identity records.
- Large-scale customer datasets.
Conclusion
January 2026 showed that the biggest risks are often the ones organisations still treat as routine.
A genetic data platform failing to secure DNA records, a public body publishing personal addresses in error and healthcare suppliers exposing operational systems through third-party weaknesses.
None of these are new threats; they are familiar failures repeated in different forms and that is exactly why regulators are becoming less patient.
For UK organisations, compliance is no longer about reacting well after a breach; it is about being able to demonstrate, clearly and consistently, that the breach should never have happened in the first place.
Disclaimer
This report is based on public disclosures, media reports, and ICO updates available at the time of writing. Figures for affected individuals may be estimated where not officially disclosed. This post is intended for informational purposes only and does not constitute legal advice.
Sources:
- 23andMe fined £2.31 million for failing to protect UK users’ genetic data
- 23andMe Enforcement Action
- 23andMe Penalty Notice
- Statement on 23andMe Investigation
- DNA Testing Firm 23andMe Fined £2.3m by UK Regulator for 2023 Data Hack
- Post Office Enforcement Action
- Post Office Reprimanded Over Horizon IT Scandal Victims’ ‘Entirely Preventable’ Data Breach
- Post Office Reprimand
- Post Office Avoids Fine Over Leak of Wrongfully Convicted Operators’ Names
- Security, Including Cyber Security
- Security, Including Cyber Security
