Cyber-attack on DBS submission firm hits islanders

Information breached included basic personal information, contact details and identity information

A personal data breach at a firm approved for submitting Disclosure and Barring Service (DBS) checks has affected some people in Guernsey, officials have said.

The Office of the Data Protection Authority (ODPA) said the UK-based company Access Personal Checking Services Ltd (APCS) had been notified that a third-party contractor had been subject to a cyber incident.

APCS said the contractor's assessment found some of its data "may have been compromised as a result".

ODPA said the information breach included individuals' basic personal information, contact details and identity information.

The ODPA said it had been contacted "by a number" of bailiwick residents affected and that it was working with the APCS. It added the impact on Guernsey residents "may be limited".

APCS said: "At present, the extent and nature of the data involved is still under investigation, and we are actively liaising with the third party to understand how and why our data may have been affected.

"We wish to reinforce that our internal operational systems were not compromised and remain fully secure.

"We will continue to provide updates to our customers as more information becomes available and remain committed to transparency throughout this process."

ODPA advised people could protect their personal information by being on guard for red flags, such as sudden increases in credit inquiries and alerts, as well as changing passwords regularly and setting up two-factor authentication.

Correction 4 September 2025: This story was changed to make it clear the firm involved was approved for submitting DBS checks, but was not a contractor of the Disclosure and Barring Service.