> series: anatomy_of_a_breach —— part: 045 —— target: greater_manchester_police —— records: 1,075 —— method: lost_usb_stick<span class="cursor-blink">_</span>_
In 2012, the Information Commissioner's Office fined Greater Manchester Police (GMP) £150,000 after a police officer lost an unencrypted USB memory stick containing sensitive personal data relating to 1,075 individuals linked to serious crime investigations. The data included information about victims, witnesses, and suspects — people whose safety could potentially be compromised if the data fell into the wrong hands. The USB stick was lost when the officer's home was burgled. It was never recovered.
The ICO's investigation found that GMP had failed to have adequate measures in place to prevent the loss of personal data stored on portable devices. Officers were using personal, unencrypted USB sticks to transfer operational data — a practice that was widespread but in direct contravention of data protection requirements. The breach echoed the MoD laptop theft of 2008 and the broader UK government data loss epidemic — the same failure (unencrypted portable media containing sensitive data), the same consequence (data loss through physical theft), the same root cause (policy without technical enforcement).
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe GMP breach was not an isolated incident. Throughout this series, we have documented the same failure repeatedly: sensitive data on unencrypted portable devices, lost through theft, carelessness, or burglary. The HMRC CDs (2007), the MoD laptop (2008), the Zurich Insurance backup tape (2008), and now the GMP memory stick (2012) — all share the same root cause and the same solution.
For law enforcement, local government, and any public sector organisation handling sensitive personal data: Cyber Essentials certification mandates encryption on portable devices and removable media. Our penetration testing and build reviews verify that encryption is technically enforced — not just documented in a policy that officers and staff may not follow. SOC in a Box for Local Government provides continuous monitoring including data loss prevention that detects when sensitive data is being copied to removable media. And UK Cyber Defence provides incident response when a data loss is discovered.
<a href="/cyber-essentials">Cyber Essentials</a> mandates encryption. Our <a href="/penetration-testing/windows-build-review">build reviews</a> verify it is enforced. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors for data being copied to removable media. Because in 2012, five years after HMRC, unencrypted USB sticks were still losing the UK's most sensitive data.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call