Anatomy of a Breach

Anatomy of a Breach: Greater Manchester Police — 1,075 People Linked to Serious Crime on a Lost USB Stick

> series: anatomy_of_a_breach —— part: 045 —— target: greater_manchester_police —— records: 1,075 —— method: lost_usb_stick<span class="cursor-blink">_</span>_

Hedgehog Security 30 September 2012 11 min read

1,075 people linked to serious crime. On an unencrypted USB stick. Lost in a burglary.

In 2012, the Information Commissioner's Office fined Greater Manchester Police (GMP) £150,000 after a police officer lost an unencrypted USB memory stick containing sensitive personal data relating to 1,075 individuals linked to serious crime investigations. The data included information about victims, witnesses, and suspects — people whose safety could potentially be compromised if the data fell into the wrong hands. The USB stick was lost when the officer's home was burgled. It was never recovered.

The ICO's investigation found that GMP had failed to have adequate measures in place to prevent the loss of personal data stored on portable devices. Officers were using personal, unencrypted USB sticks to transfer operational data — a practice that was widespread but in direct contravention of data protection requirements. The breach echoed the MoD laptop theft of 2008 and the broader UK government data loss epidemic — the same failure (unencrypted portable media containing sensitive data), the same consequence (data loss through physical theft), the same root cause (policy without technical enforcement).


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Unencrypted USB sticks — the breach that keeps happening.

The GMP breach was not an isolated incident. Throughout this series, we have documented the same failure repeatedly: sensitive data on unencrypted portable devices, lost through theft, carelessness, or burglary. The HMRC CDs (2007), the MoD laptop (2008), the Zurich Insurance backup tape (2008), and now the GMP memory stick (2012) — all share the same root cause and the same solution.

No Encryption = No Protection
An unencrypted USB stick provides zero protection when it is lost or stolen. The data is immediately accessible to anyone who finds it. Full-disk encryption for laptops and hardware-encrypted USB sticks are baseline controls that <a href="/cyber-essentials">Cyber Essentials</a> mandates. Our <a href="/penetration-testing/windows-build-review">build reviews</a> verify that encryption is enforced on all portable devices.
Personal USB Sticks in Operational Use
GMP officers were using personal, unencrypted USB sticks to transfer operational police data. This indicates both a policy failure (officers should not use personal devices for operational data) and a technical failure (USB ports should be restricted to approved encrypted devices). Our <a href="/penetration-testing/infrastructure">infrastructure testing</a> assesses USB port policies and removable media controls.
Victim and Witness Safety at Risk
The lost data included information about victims and witnesses in serious crime cases. If this data reached the wrong hands — the criminals being investigated — the consequences could include intimidation, witness tampering, or physical harm. The sensitivity of the data demanded the highest level of protection, and received the lowest.
Pattern Not Broken Since 2007
Five years after the HMRC breach prompted mandatory encryption across government, a UK police force was still using unencrypted USB sticks for operational data. The enforcement pattern we documented in the <a href="/blog/anatomy-of-a-breach-uk-government-data-loss-epidemic">data loss epidemic article</a> continued: policies existed, technical enforcement did not.

The controls that prevent this exact breach.

For law enforcement, local government, and any public sector organisation handling sensitive personal data: Cyber Essentials certification mandates encryption on portable devices and removable media. Our penetration testing and build reviews verify that encryption is technically enforced — not just documented in a policy that officers and staff may not follow. SOC in a Box for Local Government provides continuous monitoring including data loss prevention that detects when sensitive data is being copied to removable media. And UK Cyber Defence provides incident response when a data loss is discovered.


The same breach keeps happening. Has your organisation solved it?

<a href="/cyber-essentials">Cyber Essentials</a> mandates encryption. Our <a href="/penetration-testing/windows-build-review">build reviews</a> verify it is enforced. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors for data being copied to removable media. Because in 2012, five years after HMRC, unencrypted USB sticks were still losing the UK's most sensitive data.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles