0 £0.00
This item was added to your basket

Dear visitor,
You are viewing 1 of your 2 free articles


We’ve made wider, important changes to our print and online content to enhance the value of exclusive, insightful, discerning content we create every day. Support valuable editorial content by becoming a member of our Credit Club - register for free or choose a paid plan.

Register now or Login

Carphone Warehouse fined £400,000 for “systemic failures”

Carphone Warehouse has been fined £400,000 after serious failings placed more than three million of its customers’ data at risk.


Amber-Ainsley   Pritchard

Share on LinkedIn Share on Twitter
Amber-Ainsley   Pritchard
Share on LinkedIn Share on Twitter

The fine, issued today (January 10) and one of the largest the ICO has ever issued, relates to one of Carphone Warehouse’s computer systems which was compromised after a cyber attack in 2015.

 

The ICO said the company’s failure to secure the system allowed unauthorised access to the personal data of more than three million customers and 1,000 employees.

 

The compromised customer data included names, addresses, phone numbers, dates of birth, marital status and, for more than 18,000 customers, historical payment card details.

 

The records for some Carphone Warehouse employees, including name, phone numbers, postcode, and car registration were also accessed.

 

Information commissioner Elizabeth Denham said: “Carphone Warehouse should be at the top of its game when it comes to cyber security, and it is concerning that the systemic failures we found related to rudimentary, commonplace measures.”

 

The ICO considered that the personal data involved would significantly affect individuals’ privacy, leaving their data at risk of being misused.

 

Following a detailed investigation, the ICO identified multiple inadequacies in Carphone Warehouse’s approach to data security and determined that the company had failed to take adequate steps to protect the personal information.

 

The ICO said that using valid login credentials, intruders were able to access the system via out-of-date WordPress software.

 

It also found some elements of the company’s software, in use on the systems affected, were out of date and the company failed to carry out routine security testing. The ICO considered this to be a serious contravention of the Data Protection Act.

 

The commissioner added: “A company as large, well-resourced, and established as Carphone Warehouse, should have been actively assessing its data security systems, and ensuring systems were robust and not vulnerable to such attacks.”

 

However, Denham also acknowledges the steps Carphone Warehouse took to fix some of the problems and to protect those affected.

 

At the time of the attack in 2015, Carphone Warehouse set up additional security measures and contacted all customers who may have been at risk to inform them of the breach and to give them advice to reduce any risk and minimise inconvenience.

 

Denham also acknowledges that to date there has been no evidence that the data has resulted in identity theft or fraud.

Share on LinkedIn Share on Twitter
Add New Comment

LATEST INDUSTRY NEWS STRAIGHT TO YOUR INBOX

YOU MIGHT ALSO LIKE

Debt owed to UK businesses £580m higher in first three months of 2018

Major company collapses such as Carillion have seen total debt owed to UK businesses rise substantially, according to analysis from Creditsafe

Third of consumers see defaults as lenders’ responsibility

Nearly a third of consumers see defaulting on a loan payment as being the fault of the lender rather than the borrower, a report has found

Identity fraudsters shifting focus, finds Cifas

Identity fraudsters are increasingly targeting sectors such as telecoms, online retail, retail credit loans, short-term loans and insurance, according to a new report

Unsecured debt borrowing drops “significantly" in Q1

The overall supply and demand for unsecured credit has dropped significantly in the first quarter of 2018, according to the Bank of England’s (BoE) credit conditions survey

The CS Interview

The patriot

The patriot

Features

How much is a modern debt purchaser worth?

How much is a modern debt purchaser worth?

Opinion

Here we go again: Credit Awards 2018
Share on LinkedInShare on Twitter

Here we go again: Credit Awards 2018

Credit 500 - 2018/2019

The new Credit 500 - an index of influence in commercial and consumer credit - has been unveiled
Share on LinkedInShare on Twitter

The new Credit 500 - an index of influence in commercial and consumer credit - has been unveiled

Credit Strategy
LinkedIn page

Did you find our website useful?

Thank you for your input

Thank you for your feedback

creditstrategy.co.uk – an online news and information service for the UK’s commercial and consumer credit industry. creditstrategy.co.uk is published by Shard Financial Media Limited, registered in England & Wales as 5481132, Axe & Bottle Court, 70 Newcomen St, London, SE1 1YT. All rights reserved. Credit Strategy is committed to diversity in the workplace.
@ Copyright Shard Media Group