Access Personal Checking Services (APCS), a leading UK provider of criminal record checks (DBS checks) for employers, suffered a data breach originating from a third-party software developer, Intradev. The breach exposed customers' basic personal information, passport details, driving license data, and National Insurance numbers, though financial information was reportedly not compromised. APCS, which serves over 19,000 organizations—including sectors like healthcare, finance, and child/vulnerable adult services—notified affected customers via email. The attack was detected on August 4, with Intradev (NCSC Cyber Essentials-certified) confirming unauthorized malicious activity in its systems. While the exact attack vector (e.g., ransomware) remains unconfirmed, the incident was escalated to the ICO and Action Fraud. The scope of the breach, including the number of impacted individuals, is still under investigation. The compromised data could enable identity fraud or phishing, posing risks to both employees and customers whose sensitive records were processed through APCS’s DBS checks.