More company fluff and useless ICO.
They probably can't know everything that was accessed using legitimate credentials by illegitimate users, so saying only limited amount of data was affected might well be true, but that limit might be 100% of the data available by the method used.
What is the point of the ICO if they won't act, not much point having a regulator if they won't regulate.
I wonder if the GDPR will help with this kind of issue?
Biting the hand that feeds IT
