Doncaster Council is probing a data breach after sensitive DBS data was hacked.

Letters have been sent to people who applied for checks through the Disclosure and Barring Service which identifies candidates who may be unsuitable for certain work - especially involving children or vulnerable adults - and provides wider access to criminal record information.

The letter, seen by the Free Press tells people that information such as names, phone numbers and dates of birth could have been accessed and reads: “I am contacting you concerning a recent breach of personal data affecting one of the companies used by City of Doncaster Council.

"The breach has affected you as you have applied for a DBS via the Access Personal Checking Services Ltd (APCS) website.”

City of Doncaster Council has confirmed DBS data was hacked.

placeholder image — City of Doncaster Council has confirmed DBS data was hacked.

The letter goes on to say: “On 17th August 2025, we were notified by Intradev Limited, APCS's contracted software supplier, that they had been a victim of a cyber-attack, and an area of their system had been subject to unauthorised access.

"The incident itself occurred on 31st July 2025. Intradev confirmed that the attackers were able to copy a number of files and some of these files contained personal data.

“Your data was not accessed from our systems directly. City of Doncaster Council and APCS's systems remain secure.”

Data breached included names and addresses, phone numbers, dates of birth and National Insurance numbers as well as driving licence and passport details.

The letter added: “While your information was accessed, this does not mean it will be misused.

“As your contact information was affected you might receive some spam calls or more targeted marketing attempts.

“As your National Insurance number, passport or driving licence details were affected the potential impact could be higher. These details could potentially be used to impersonate you for new applications, therefore we recommend taking precautionary steps.”

The note then goes on to outline the security measures needed to be taken.

The letter adds: “City of Doncaster Council takes all breaches of data protection very seriously and we apologise for this regrettable incident occurring.

"In accordance with our internal procedures, we have assessed the breach and notified the Information Commissioners Office who govern information rights legislation, including the Data Protection Act 2018 and General Data Protection Regulation

“The Information Commissioner will now review the case and decide if any further action needs to be taken.”

Debbie Hogg, Executive Director of Corporate Resources at City of Doncaster Council said: “We can confirm that a breach of personal data took place affecting a company engaged by City of Doncaster Council.

"We were notified by the company and promptly reported the breach to the Information Commissioners Office.

“The individuals affected had applied for a DBS (Disclosure and Barring) check online. As such the data was not held by the council.

“We have written to affected individuals to advise them of the breach and made security recommendations. The company have also taken action to enhance their security arrangements.

“City of Doncaster Council takes all breaches of data protection very seriously and it is disappointing that this incident has occurred.”