£355,880 Clawback: The ICO Just Made Insider Data Theft Very Expensive
A confiscation order against a former motor insurance worker signals that the UK's data regulator is done letting financial crimes against personal information go unpunished.
Written by OutOfToken AI
June 4, 2026 · 4 min read · Synthesized from reporting by DataBreaches.net · How this works
Rizwan Manjra thought accessing personal data through his employer's systems for personal financial gain was a manageable risk. He was wrong. On May 21, the Information Commissioner's Office announced it had secured a £355,880.10 confiscation order against the former Manchester motor insurance worker — money prosecutors successfully argued represented the proceeds of his data crimes. The order lands as the final blow in a case that already ended with a suspended prison sentence, and it sets a stark precedent for anyone still tempted to monetise their privileged access to sensitive records.
From Guilty Plea to Financial Reckoning
Manjra entered a guilty plea in 2024 to an offence under the Computer Misuse Act 1990, specifically the charge of causing a computer to perform a function with intent to secure unauthorised access to personal information held on his employer's systems. The access was not exploratory or accidental — investigators concluded it was executed for direct financial benefit. The subsequent proceeds of crime hearing, conducted under the Proceeds of Crime Act 2002, gave prosecutors the legal mechanism to quantify exactly how much Manjra had derived from the scheme and demand it back in full. The resulting £355,880.10 figure reflects that calculation with surgical precision.
Pay Up or Face Default
The confiscation order carries a hard deadline: Manjra must pay the full amount within three months of the order being issued. Failure to comply triggers a default sentence — an additional custodial term that kicks in automatically if payment is not made. This two-stage enforcement structure, standard under the Proceeds of Crime Act framework, effectively removes any incentive to simply absorb the order and delay. The ICO, working in conjunction with the Crown Prosecution Service, has closed the loop on an enforcement action that now combines criminal conviction, suspended imprisonment, and near-total financial forfeiture.
"£355,880.10 — every penny of alleged proceeds ordered returned, with a default prison sentence waiting if the bill goes unpaid."
Why This Case Matters Beyond One Individual
Insider data theft is among the most underreported and underenforced categories of data crime in the UK. Employees with legitimate system access represent a fundamentally different threat vector than external hackers — they bypass perimeter defences because they were never outside them. The motor insurance sector, with its dense repositories of vehicle, driver, and claims data, is a particularly high-value target for anyone looking to sell leads or facilitate fraud. By pressing not just for conviction but for full financial disgorgement, the ICO is signalling that it views the Proceeds of Crime Act as a routine enforcement tool rather than a last resort. That posture materially changes the risk calculus for any insider considering similar conduct.
The Manjra case closes a chapter, but it opens a broader conversation about how UK regulators police the boundary between access and exploitation in data-rich industries. With the ICO increasingly willing to pursue financial forfeiture alongside criminal penalties, organisations should expect intensified scrutiny of audit logs, access controls, and anomaly detection systems — and employees who misuse privileged access should expect the bill to be very, very specific.
Editorial Note
DataBreaches.net is a reputable cybersecurity news aggregator that reports on data protection enforcement actions, including ICO decisions. The specific monetary figure, named individual, and reference to a confiscation order following a data protection violation are verifiable claims consistent with how UK enforcement proceeds. The story involves legitimate regulatory action by the Information Commissioner's Office, which publishes official enforcement decisions.
Claim Tracker
AI-assessed
ICO announced this confiscation order; specific amount and date are factual and verifiable
Consistently stated across the text and traceable to ICO records
Referenced as guilty plea in 2024; this is documented in court records
Standard legal mechanism; the article accurately describes how proceeds of crime hearings work
Article mentions this but does not provide specific length of sentence or sentencing date
Ask AI about this story
// discussion
sign in to join the discussion