Equifax was subject to a cyber-attack between May and June 2017 in the US, which affected the personal data of 15m people in the UK. The personal information lost or compromised during the incident ranged from names and dates of birth to addresses, passwords, driving licence and financial details.

In its ruling, the ICO said that Equifax had "failed to take appropriate technical and organisational measures against unauthorised and unlawful processing of that data".

The ICO’s probe was carried out with the Financial Conduct Authority and found multiple failures at the credit reference agency.

The investigation was carried out under the Data Protection Act 1998, rather than the current GDPR, as the failings occurred before stricter laws came into force in May of this year. Hence the fine is the maximum allowed under the DPA.

Elizabeth Denham, Information Commissioner said: "The loss of personal information, particularly where there is the potential for financial fraud, is not only upsetting to customers, it undermines consumer trust in digital commerce.

"Many of the people affected would not have been aware the company held their data; learning about the cyber attack would have been unexpected and is likely to have caused particular distress. Multinational data companies like Equifax must understand what personal data they hold and take robust steps to protect it."