The Metropolitan Police Service let officers create about 500 free Auror accounts between March 2023 and September 2024, and the UK Information Commissioner’s Office responded with an enforcement notice. The force had not formally procured the retail-crime platform or completed the data protection checks it was supposed to.
Auror is a browser and mobile app retailers use to share incident reports, images, and CCTV footage. In practice, officers used it to upload personal data on 179 people, including children, so the problem was not a hacked system but uncontrolled sharing through an outside service that bypassed procurement and privacy review.
The ICO says the failure is still live in the governance layer: if staff can self-adopt third-party SaaS, policy reminders alone do not stop sensitive data from leaving the organization. For police forces and any other shop-floor operation, the exposure is the unapproved platform and the data it already received, not a single compromised host.