Carphone Warehouse fined £400k for data breach
Written by Chris Lemmon
The Information Commissioner’s Office (ICO) has issued Carphone Warehouse with a £400,000 fine after “serious failures” placed customer and employee data at risk.
The fine relates to an incident in 2015 when the retailer was subject to a cyber attack which compromised the personal details of more than three million customers and 1,000 employees.
The compromised data included: names, addresses, phone numbers, dates of birth, marital status, and historical payment card details. The records for some employees, including name, phone numbers, postcode, and car registration were also accessed.
The ICO considered that the personal data involved would significantly affect individuals’ privacy, leaving their data at risk of being misused. The ICO identified multiple inadequacies in Carphone Warehouse’s approach to data security and determined that the company had failed to take adequate steps to protect the personal information.
According to the ICO, important elements of the company’s software were out of date and enabled intruders to access the system via such flaws. Routine security testing was not carried out and there were also inadequate measures in place to identify and purge historic data.
Information Commissioner Elizabeth Denham said: “A company as large, well-resourced, and established as Carphone Warehouse, should have been actively assessing its data security systems, and ensuring systems were robust and not vulnerable to such attacks.
“Carphone Warehouse should be at the top of its game when it comes to cyber-security, and it is concerning that the systemic failures we found related to rudimentary, commonplace measures. The real victims are customers and employees whose information was open to abuse by the malicious actions of the intruder.
“The law says it is the company’s responsibility to protect customer and employee personal information,” she continued. “Outsiders should not be getting to such systems in the first place. Having an effective layered security system will help to mitigate any attack – systems can’t be exploited if intruders can’t get in.
“There will always be attempts to breach organisations’ systems and cyber-attacks are becoming more frequent as adversaries become more determined. But companies and public bodies need to take serious steps to protect systems, and most importantly, customers and employees.”
Carphone Warehouse has released a statement in response to the fine, which reads: “We accept the decision by the ICO and have co-operated fully throughout its investigation into the illegal cyber attack on a specific system within one of Carphone Warehouse’s UK divisions in 2015.
“As the ICO notes in its report, we moved quickly at the time to secure our systems, to put in place additional security measures and to inform the ICO and potentially affected customers and colleagues. The ICO noted that there was no evidence of any individual data having been used by third parties.
“Since the attack in 2015 we have worked extensively with cyber security experts to improve and upgrade our security systems and processes. We are very sorry for any distress or inconvenience the incident may have caused.”