The UK criminal records office got a reprimand after attackers kept access to its CMS for seven months.