Data Breach – Data associated with DBS checks through Access Personal Checking Service (APCS)
We have been made aware that the software supplier of the external organisation that we use for conducting DBS checks (APCS) has had a significant cyber-attack resulting in a data breach. Personal information used to check identification has been compromised including names, dates of birth, addresses, and passport / driving licence details. APCS has confirmed that they do not store payment card details or records of any criminal convictions.
On 17 August 2025, APCS were notified by Intradev – their external software supplier – of a potential data breach. Intradev confirmed that they have been subject to unauthorised access and certain files that relate to personal data were copied from their systems during a recent cyber-attack.
We are led to believe the data breach concerns data collected between December 2024 and 8 May 2025.
APCS and our own diocesan network and servers were not compromised.
APCS is working with Dioceses affected and conducting a thorough investigation to determine the full scope of the data involved.
We understand that 13,000 people have been affected by the data breach across the country and this included 327 people who had completed a DBS check via the Hereford Diocesan Office. We are currently contacting all these people directly, so if you haven’t received an email from Kerry Preedy over the next couple of days then there is no indication any of your personal information is affected by this breach.
We are liaising with APCS to understand how many of our parishes complete their own DBS checks and may have been affected. If you have received an email from them and haven’t already let us know, please contact us so we can provide any support you might need in contacting individuals affected / completing reports. Carl Steventon has sent a separate email to all Parish Safeguarding Officers (text at the end of this statement).
If your parish completes its own DBS checks using APCS, and you have been notified that the parish is affected by the breach, it is important that the parish itself files a report with the Information Commissioner’s Office (ICO) – we can provide templates and guidelines to help you do this if necessary. This is because PCC’s (like the DBF) are a separate legal entity, and we have been told it is not possible for the DBF or the national team to make a ‘blanket’ report for all affected legal entities. However, we have already notified the Information Commissioner’s Office and the Charity Commission, so they are aware of the breach. The Charity Commission has told the national Church that unless parishes are in a 'unique position', they do not need them to file serious incident reports with the Charity Commission, because they already have sufficient information.
We will provide an update if we have any further information but, in the meantime, please continue to remain vigilant in managing your own personal information online to minimise any potential risk, especially if you are approached by any unknown individual or organisation that may not appear genuine and if you receive any phishing emails that contain harmful links or attachments.
Support for individuals affected by the data breach:
The National Church Institutions is offering 12 months of free credit and web monitoring services, provided by Experian, to individuals within the Church of England affected by the breach. The Experian Identity Plus account helps detect possible misuse of personal data and provides people with identity monitoring support, focused on the identification and resolution of identity theft.
Access codes will be made available to our diocese to distribute and instructions about how you can access your Experian account will also be sent shortly.
We have set up a dedicated email for anyone to ask advice about this situation. If you have any concerns at all email us on dataprotection@hereford.anglican.org
APCS Data Breach | FAQs
The following FAQs are available to download as a Word document or PDF, or you can click on the '+' signs to expand and view each answer.
About the breach
A: We have been notified that one of their suppliers Access Personal Checking Services Ltd (APCS) has been subject to a significant data breach. ACPS carries out Data and Barring Services (DBS) checks on behalf of the National Church Institutions (NCIs), some Dioceses and Parochial Church Council (PCCs). The breach has affected clergy, lay ministers, volunteers, and staff.
A: This breach has impacted people across the Church who have been subject to a recent DBS check. APCS carries out DBS checks on behalf of some Dioceses and PCCs, and the NCIs.
A: APCS specialise in processing disclosures for individuals and small business owners, large public and private sector companies, organisations, and recruitment agencies.
A: APCS have stated that their external software supplier, Intradev, notified them on 17 August that their system had been compromised between the 31 July 2025 and 15 August 2025, and certain files containing personal details were copied. APCS were provided with copies of the compromised data on Monday 18 August. APCS’ own network and servers were not compromised. From initial assessments made by APCS, the data that is affected is from 1 December 2024 to 9 May 2025.
A: Yes. APCS provides Data and Barring Services (DBS) to many organisations. This breach also impacts those bodies.
A: APCS have started the process of notifying those individuals affected by the breach. APCS have said that the breach only affects those individuals who were subject to a DBS check between the 1 December 2024 to 9 May 2025, but this is a moving situation, and we will keep you updated as we receive more information.
A: No. The two incidents are unconnected.
A: We are waiting for more details from APCS. We understand that the breach may have affected some or all the following information:
- Name, phone number, date of birth, email address, address, place of birth, National Insurance number, passport number, driving licence number.
It does not include:
- Medical information, information on any disclosures, information about your protected characteristics e.g., ethnicity, disability, sexual orientation, marital status.
The information that was accessed was in text format only. No documents, images, passwords, or financial details were affected.
A: Although this breach has been caused by APCS and their Intradev system, it is the Diocesan staff in the office who are doing all of the contacting and sorting out of this issue. So far:
- People affected by the data breach have been contacted with advice and support.
- Support includes 12 months free access to a credit checking and monitoring service from Experian.
- Bishop Richard has contacted people personally affected
- All DBS checks with APCS have been paused until further notice.
- Webpages have been created and Parish Safeguarding teams have been contacted.
- This incident has been reported to the Information Commissioner's Office (ICO) and the Charity Commission.
Reporting the breach and data protection
A: Yes. PCCs should report separately to the ICO if they have directly accessed the service i.e. if they have been uploading data to APCS themselves this makes them the data controller. If the DBF have been doing this on their behalf, then the DBF should report as the data controller. You can assess this by checking who APCS is corresponding with i.e. if they have contacted the PCC directly, then it is likely that the PCC is the controller and therefore must report.
Whether the PCC is part of the national deal is not the issue for reporting to the ICO, the key issue is who the controller is, so if the PCC have their own contract with APCS and have been contacted, they must report it.
A: Only the data controller is responsible for reporting a high-risk data breach to the ICO. A high-risk data breach is one which has a significant effect on the rights and freedoms of data subjects. All parties are accountable for taking steps to mitigate the effects of the breach where possible.
If the data breach is caused by the processor, the processor must implement technical and organisational measures to assist the controller to deal with the breach but is responsible for their own failures or those of their sub-processors. However, the ICO can investigate all parties involved to ensure they have met their obligations appropriately.
A: The Charity Commission have informed the National Church Institutions that due to the large number of Serious Incident Reports they have received on this, trustees in PCCs and diocesan boards of finance do not need to report to the Charity Commission "if in substance they simply wish to report the same incident in materially similar terms".
A: The 72-hour window is based on when your organisation became aware of the data breach (i.e. when the email sent from APCS was seen). If you have missed the 72-hour deadline, you can explain that the reason for the delay is because you were fact finding, but it is best if you can do this as close to the 72-hour window as possible.
A: If you wish to make an erasure request, you can contact APCS via email to enquiries@accesspcs.co.uk or by phone on 0845 6431145. The APCS Privacy policy is available here: www.onlinecrbcheck.co.uk/docs/privacypolicy.pdf
A: A data controller is the organisation responsible for making the key decisions about how and why data is collected, stored, and used and is responsible for complying with all GDPR obligations. Where the controller uses an external supplier who will be processing personal data for the controller (data processor), the overall responsibly for data protection compliance remains with the data controller.
A controller is responsible for ensuring that the processors have provided sufficient assurance that they are GDPR compliant, and for putting in place a suitable contract which should include instructions on how a data breach will be managed.
In the APCS situation the controller would be the organisation responsible for uploading data to the APCS system, for example the Church of England Central Services, a Diocesan Board of Finance, or Parochial Church Council.
A data processor is responsible for processing personal data solely on behalf of the controller adhering strictly to the controller's documented instructions. They are responsible for complying with their own GDPR obligations, including putting in place a suitable contract which provides an equivalent level of data protection as the contract with the controller. with any of their sub-processors. The processor must immediately inform the controller of any data breaches. In this case APCS is the data processor.
A sub-processor is a supplier providing processing services to the primary data processor. They are responsible for processing personal data on behalf of the primary data processor, under a suitable contract. This includes implementing appropriate security measures to protect the data, complying with relevant GDPR obligations and assisting the primary processor and controller to meet their data protection obligations. In this case Intradev is the sub processor.
A: In the event of a data breach, the data controller is responsible for submitting a report to the ICO. In this instance, the “controller” is the organisation responsible for uploading data to the APCS system, for example, the PCC.
Support for people affected
A: Access to a credit checking and monitoring service from Experian is being made available for 12 months for those affected. If you have been affected by this data breach and you have not received a code to access your Experian Identity Plus account, please contact k.preedy@hereford.anglican.org. More information about the service available from Experian is contained within these FAQs. Advice about what additional steps you can take, and the resources available to help protect you from fraud, are also included in these FAQs.
A: k.preedy@hereford.anglican.org
A: We do not believe it is necessary to replace driving licences or passports, as the images associated with these documents were not breached. However, if you feel strongly about this then we suggest that you keep a copy of any costs incurred so that we can seek compensation from APCS.
A: We are encouraging all colleagues who are potentially affected by this to sign up to the Experian service. This service, provided for 12 months, will help you to keep an eye out for any changes that suggest someone is using your data improperly – for instance, you will get an alert if someone sets up a new credit agreement. If you become the victim of fraud, you will be offered help through Experian’s caseworker service to get back on track and sort out your credit file.
In addition, you should look out for any unwanted calls, emails or contact to you directly, including monitoring your bank account. You might find it helpful to talk to your bank now to let them know of the situation. Some are able to put in place additional identification verification checks for making/setting up payments, to help keep your money safe.
A: The Diocese will work alongside you and do what we can to ensure no colleagues loses out as a result of this breach by APCS. In the hopefully rare event where someone suffers a loss, we will work with you to help rectify the situation.
A:
- Stay alert to unexpected emails, calls, or letters that mention personal details about you.
- Never give personal information to unsolicited callers, even if they seem to know details about you.
- Verify any unexpected contact by calling the organisation directly using their official number.
- Monitor for new applications made in your name: o Check your credit report – see below for information about the service that will be available to you from Experian shortly. o Look for any new accounts, credit searches, or applications you did not make.
- Inform your bank, building society and credit card company of any unusual transactions on your statement.
Experian Identity Plus
A: k.preedy@hereford.anglican.org
A: Features of the Experian Identity Plus account includes:
- Daily Experian Fraud Report If you log in, you can get your daily Experian Fraud Report. This details key information from your Experian Credit Report that may help you identify fraudulent activity on your credit report.
- Alerts provided as part of the service Alerts will be provided by email and/or SMS, depending on your settings and features availability.
- Experian fraud alerts Get alerts by email and/or text message about certain changes to your Experian Fraud Report. Alerts relate to when accounts are opened or closed, or when your credit report is searched. Some of our credit alerts may be sent in real-time to notify of certain changes when they happen, others are sent weekly.
- Experian CreditLock alerts Experian will let you know when your Experian credit file is searched and if your credit file was locked. For any applications that are blocked you will be sent a message by email and/or text to make you aware.
- CreditLock Experian CreditLock is designed to reduce fraudulent credit applications. Locking your Experian Credit Report will help to block new fraudulent credit applications made in your name, using your information from the Experian Credit Bureau.
- Web monitoring Experian will help you better protect your identity by scanning certain internet sites and locations for selected personal and financial details and alerting you by email or text message if anything looks wrong or fraudulent. Alerts are sent every day that we find suspicious information. Web monitoring is designed to work alongside taking a cautious approach to your sharing of data and use of the internet and other digital services. Read this guide to Identity Plus for more details
A: If you are not sure where to start, take a look at this guide from Experian: www.experian.co.uk/consumer/experian-credit-report.html
Your credit report has different sections. For instance, it will show information about you, any credit agreements you have (e.g. your mortgage or with a phone company), your financial connections (e.g. spouses/partners), and details of any missed/overdue payments on credit agreements.
A: At the end of the 12-month period the individuals will get an email to say their subscription is coming to an end and the options available to them.
A: Through your Experian Identity Plus subscription*, you will be offered daily alerts as to whether something has changed within your credit report. The subscription also allows you to lock your Experian credit report to help stop fraudsters taking out agreements in your name.
A: Experian is a member of CIFAS (Credit Industry Fraud Avoidance System) and can access data related to confirmed fraud cases. CIFAS focuses on fraud prevention; Experian offers identity verification and fraud prevention.
A: If when you log into Experian using the code we have given you, and you are using your personal email address, you may be told that you already have an account under that username. In this case either continue to use your existing account if you are still paying for it and let us know that you do not need the code or create a new account using a different email address. If you need further assistance, please call the Experian support line on 03444 818182.
A: When you create the account, you will be asked for your email address as a username, you should use your own personal email account because reports from Experian contain your own personal financial information which should not be held in a work email inbox (see above). You may be asked for date of birth and address so that Experian can identify you, and they may ask you for additional data, for example, your mother’s name as an additional security check. They will already know some of your financial arrangements e.g. mortgage information and bank account details etc, or other financial arrangements where you have had to get a credit check, and they will ask you to confirm these. They need these details to ensure that they monitor all your financial arrangements, however, they also collect data for marketing purposes. You should read their Privacy Notice here: Experian Consumer Privacy Policy To opt out of marketing click here: Opt out by marketing channel and industry sector - Experian Consumer Information Portal
Other/general
A: Please do not offer any comment and refer them to our communications team communications@hereford.anglican.org
TEXT OF CARL STEVENTON’S EMAIL TO PARISH SAFEGUARDING OFFICERS
Dear Parish Safeguarding Officer,
Subject: Important Update – APCS Data Breach and DBS Processing
You may be aware that Intradev, the software supplier to our DBS provider, Access Personal Checking Service (APCS), has suffered a data breach, affecting personal data collected between December 2024 and 8 May 2025.
A data breach is a security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This breach has impacted several dioceses, including the Diocese of Hereford.
APCS has a processing arrangement with the Diocese of Hereford to carry out DBS checks. Anyone affected by the breach will be contacted directly by the Diocese, who will provide full details of the breach and the next steps to take.
If your parish has used APCS independently (i.e. outside the checks processed by the Diocese), you may receive a separate communication directly from APCS. If you do receive such a message, you must:
1. Report the breach to the Information Commissioner’s Office (ICO) (we can help with this).
2. Notify all individuals whose data may have been compromised.
APCS will provide you with the relevant information regarding those affected.
In the meantime, we have received guidance from the national church advising that no further DBS checks should be processed via APCS until further notice.
Please note:
• Do not verify any new DBS applications, even if reminder emails are received.
• Ensure all parish verifiers are made aware and instructed not to proceed with verifications.
We will issue further updates as soon as we receive more information from the national church or once assurances are provided regarding APCS’s data security.
Useful Links and contact numbers
Action Fraud
The government has put together this checklist to help on the steps to take to repair your identity and prevent re-victimisation.
The National Fraud and Cyber Crime Reporting Centre has a wealth of advice and resources on the Action Fraud website.
- www.actionfraud.police.uk
- Call Action Fraud on 0300 123 2040
GOV.UK
- Advice from GOV.UK on the actions you should take if you have shared personal information
Financial Ombudsman Service
If you have lost money because of fraud or a scam – and you are unhappy with how your bank or payment service provider handled things – The Financial Ombudsman Service may be able to help.
General advice
- www.citizensadvice.org.uk
- Call Citizens Advice on 0808 223 1133
To report the theft or loss of post
- Royal Mail website: www.royalmail.com/report-a-crime
- Or call Royal Mail on 08457 740 740