Travel visa delays after UK’s crime records office hit by cyber ‘incident’

The process of securing an overseas visa has been thrown into disarray after UK’s criminal records office was hit with a two-month cyber security “incident”, the Standard can reveal.

ACRO, the national policing body which manages criminal record information and the exchange of records with other countries, was hit with a cyber security “incident” for two months on its website between January 17 and March 21st.

According to an email sent to those affected this week, the agency warned while it had no conclusive proof of a data breach, there is the possibility that data sent to it by customers such as “identification information and any criminal conviction data” was affected.

It has piled on backlogs to obtain a police certificate, which are crucial for obtaining many visas to popular destinations such as the US, New Zealand and Canada.

The agency’s website is down, meaning the applications for police certificates must be processed manually by email.

An ACRO spokesperson confirmed to the Standard: “We are aware of a cyber security incident affecting the ACRO Criminal Records Office website and are working with national agencies to fully investigate.

“We take data security very seriously and as soon as we were made aware of this incident we took the customer portal offline.

“At this time we have no conclusive evidence that personal data has been affected by the cyber security incident.”

The spokesperson could not say how many people have been warned that their data may have been affected.

One frustrated customer said in a message to ACRO: “We have to get [a] police certificate for NZ visa. We have been ready for sometime except your site is preventing us proceeding.

“If we don't apply soon then another medical is needed. These are not cheap!”

Another added that they requested and paid for a police certificate a month ago but were yet to receive a response.

“This is beyond urgent for visa purposes and I have no way of contacting via website or phone!” she said.

A third said: “It's unbelievable the service for getting police certificates has been broken for a while now and no sign of it getting fixed.”

The agency had previously only told customers that website “technical issues” has created a backlog in processing the applications.

Those contacting ACRO’s helpline in a bid for an update on their applications for a police certificate are being warned of lengthy waits. Some have reported being cut off.

ACRO has said it is putting further resources into its customer service team in order to clear the backlog.

Applications for International Child Protection Certificates (ICPCs), used for UK nationals intending to work with children overseas, are also affected.

One of the services it provides is to check whether a suspect in the UK has criminal convictions in other countries. An ACRO spokesperson said this service was not disrupted.

“ACRO, a national policing unit, provides several services to members of the public including Police Certificates and International Child Protection Certificates as well as supporting UK and international law enforcement,” said the spokesperson.

“We are still able to accept applications for Police Certificates and International Child Protection Certificates via email and are working with partners to restore the website service as soon as possible.”

The Information Commissioner’s Office, which is the UK’s data watchdog, said it was aware and that it was “making enquiries”.