Data breach incidents/compensation claims
Case reference FOI2025/00764
Received 15 April 2025
Published 15 May 2025
Request
I am writing to request information under the Freedom of Information Act, please can you provide the following:
1. The number of data breach incidents the council has had in the last three years (between April 6th -April 5th 2022/23, 2023/24 and 2024/25) Broken down by years. 1a) Of those, how many were cyber-incidents? (Broken down by years as above).
2. How many compensation claims have been brought against the council for data breaches in the last three years (between April 6th -April 5th 2022/23, 2023/24 and 2024/25) Broken down by years.
2a) Of those, how many were settled with compensation? 2b) Of those, how many were refused?
2c) How much has the council paid out in compensation for data breach claims in the last three years? Broken down by years as above.
** By data breaches I refer to any or all information security incidents reported to your team that affect the confidentiality, integrity, and availability of the Council’s data - including those that have been reported to the ICO.
Response
1. The number of data breach incidents the council has had in the last three years (between April 6th -April 5th 2022/23, 2023/24 and 2024/25) Broken down by years.
A: 6th April – 5th April 2022/2023 = 97 data incidents
6th April -5th April 2023/2024 = 257 data incidents
6th April – 5th April 2024/2025 = 282 data incidents
Please note that all data incidents are recorded whether they are internal or external, we do not record these separately. Internal incidents could be anything from paperwork left on the photocopier to an email being sent to the incorrect recipient within the council. Therefore, the above figures are the total numbers including both internal and external incidents, not just external ones.
1a) Of those, how many were cyber-incidents? (Broken down by years as above).
A: There have been no cyber-incidents for any of the years requested. 2. How many compensation claims have been brought against the council for data breaches in the last three years (between April 6th -April 5th 2022/23, 2023/24 and 2024/25) Broken down by years.
A:
|
No. of claims |
Paid out |
Rejected |
|
|
2020 |
2 |
£53,211.67 |
0 |
|
2021 |
0 |
£0.00 |
|
|
2022 |
2 |
£53,127.80 |
0 |
|
2023 |
2 |
£9,000.00 |
1 |
|
2024 |
0 |
£0.00 |
0 |
|
2025 |
1 |
£10,000.00 |
OPEN |
2a) Of those, how many were settled with compensation?
A: From 2022 – 2025 4 claimants were compensated with 1 currently open
2b) Of those, how many were refused?
A: 1 claim refused in 2023
2c) How much has the council paid out in compensation for data breach claims in the last three years? Broken down by years as above.
A: See table provided above
Documents
This is Herefordshire Council's response to a freedom of information (FOI) or environmental information regulations (EIR) request.
You can browse our other responses or make a new FOI request.