Data Breach - what are my daughters rights

smallzoo2

Hi

My daughter who is 23 has 2 part-time jobs, one of which is at an college and involved applying for a DBS through the college. 

She has been working there a month or two already and has just received this message ( I have removed the actual names )

She is really worried me is the information they have breached which included NI, Passport, DOB etc

Should she apply for a new passport and driving licence so she has a different number ?

If yes then are the college or company responsible and should pay compensation

Thanks

Summary of info sent to my daughter :-
****************************************************

We wanted to make you aware of a data security incident involving one of our third-party providers that has affected some of your personal information, and to offer our guidance and support to help you stay protected.

What has happened

Our third-party provider, XXXXX manages our DBS application processes. On 18 July 2025, their external software provider, ZZZZ, experienced a cyber security incident which involved access to their systems by unauthorised individuals. ZZZZ notified XXXX about the impact to data on 17 August 2025. In turn, XXXX made us aware of what happened on 26 August 2025.

It is important to be clear that:

• Your data was not accessed whilst on our systems

• Our systems remain secure and we have not been subject to any security

incident

However, XXXX has advised us that some of your personal information is included within the data set that was accessed as part of the cyber incident experienced by their software provider. The impacted data was that which was provided to XXXX for the purpose of conducting your DBS check. It is comprised of:

• Address, NI Number, Birth Town, Name, Phone Number, Driving Licence,Passport, DateOfBirth

The impacted data does not include the result of your DBS check. In addition, only text data was affected. No copy documents, images, passwords or financial information were accessed.

What we have done

Notifying the Information Commissioner’s Office; and Continuing to monitor the situation closely – we will update you if we learn of any further specific threats.

tacpot12

It's very difficult to say what risk your daughter is at. Without the physical documents that the Driving License Number and Passport Number relate to, I don't think the the risk is so great, but you never know. 

This Guardian article provides some advice about what to do if your actual driving license is stolen, but I think much of it is relevant in cases where your drivers licence number has become public knowledge: What to do if your driving licence is either lost or stolen | Consumer affairs | The Guardian

I think I would probably apply for a replacement driving licence, and say that it has been lost. She can still drive while she waits for the replacement to arrive.

Once she has her driving licence, she can apply to change her passport, again reporting it as lost rather than stolen.  
 

elsien

The other alternative would be to apply for protective registration with CIFAS if she had worried about people making application applications in her name.
It will be more of a pain if she does want to apply for anything because there will be more hoops for her to jump through, but that’s all part of the protection process.

Undervalued

smallzoo2 said:

Hi

My daughter who is 23 has 2 part-time jobs, one of which is at an college and involved applying for a DBS through the college. 

She has been working there a month or two already and has just received this message ( I have removed the actual names )

She is really worried me is the information they have breached which included NI, Passport, DOB etc

Should she apply for a new passport and driving licence so she has a different number ?

If yes then are the college or company responsible and should pay compensation

Thanks

Summary of info sent to my daughter :-
****************************************************

We wanted to make you aware of a data security incident involving one of our third-party providers that has affected some of your personal information, and to offer our guidance and support to help you stay protected.

What has happened

Our third-party provider, XXXXX manages our DBS application processes. On 18 July 2025, their external software provider, ZZZZ, experienced a cyber security incident which involved access to their systems by unauthorised individuals. ZZZZ notified XXXX about the impact to data on 17 August 2025. In turn, XXXX made us aware of what happened on 26 August 2025.

It is important to be clear that:

• Your data was not accessed whilst on our systems

• Our systems remain secure and we have not been subject to any security

incident

However, XXXX has advised us that some of your personal information is included within the data set that was accessed as part of the cyber incident experienced by their software provider. The impacted data was that which was provided to XXXX for the purpose of conducting your DBS check. It is comprised of:

• Address, NI Number, Birth Town, Name, Phone Number, Driving Licence,Passport, DateOfBirth

The impacted data does not include the result of your DBS check. In addition, only text data was affected. No copy documents, images, passwords or financial information were accessed.

What we have done

Notifying the Information Commissioner’s Office; and Continuing to monitor the situation closely – we will update you if we learn of any further specific threats.

Data protection is one of the few area where a breach might give rise to an entitlement to some limited compensation even without suffering an actual loss.

I would contact or at least look at the Information Commissioner's website for further guidance.

JJG

The driving license number doesn’t change if you order a replacement.

Mands

JJG said:

The driving license number doesn’t change if you order a replacement.

Neither does the passport number in many parts of the world. The OP doesn't say what nationality passport they hold but worth noting that for much of the world the number stays through life. 

Grumpy_chap

smallzoo2 said:

Hi

My daughter who is 23 has 2 part-time jobs, one of which is at an college and involved applying for a DBS through the college. 

She has been working there a month or two already 

Undervalued said:

Data protection is one of the few area where a breach might give rise to an entitlement to some limited compensation even without suffering an actual loss.

Any claim for compensation would need to be with consideration of how that might affect the relationship with the employer (and her studies if she is studying at the same college).

Naturelover22

Is this the incident? It seems like a large set of data but no numbers for how many people's details were taken.
It has affected many employers and it seems also the church of england as search results on google list all of their statements.
Last week there were more news articles about the news but not as easy to find now.

I think it is tricky as it is your daughter's data but the college is the client so I would ask how they plan to be updated on the outcome and it's effects on your daughter and coursemates.

I would ask her to check her credit report as the data was stolen in July and be extra careful of suspicious messages.

https://www.theregister.com/2025/08/22/apcs_breach/

https://www.google.com/amp/s/www.bbc.com/news/articles/cqjykl2zpyeo.amp

smallzoo2

Thanks to all

Marcon

Mands said:

JJG said:

The driving license number doesn’t change if you order a replacement.

Neither does the passport number in many parts of the world. The OP doesn't say what nationality passport they hold but worth noting that for much of the world the number stays through life. 

If it's a UK passport, then the number will definitely change. Taken from https://www.gov.uk/renew-adult-passport#:~:text=Check%20how%20long%20it%20will,number%20as%20your%20old%20one.

If you need a passport urgently, you can find out more about the Online Premium or 1 week Fast Track services.

Do not book travel until you have a valid passport - your new passport will not have the same number as your old one.