ICO Dishes £400,000 Fine To Carphone Warehouse For 2015 Data Breach

Carphone Warehouse has been fined £400,000 for a 2015 cyberattack that saw the personal details of more than three million customers and 1,000 employees exposed to criminals.

The penalty is one of the largest ever dished out by the Information Commissioner’s Office (ICO) and reflects the inadequacies found in the company’s cybersecurity measures following an investigation.

The ICO said the data stolen – which included names, phone numbers, dates of birth and historical payment card details – meant customer and employee privacy was at risk.

ICO Carphone Warehouse fine

“A company as large, well-resourced, and established as Carphone Warehouse, should have been actively assessing its data security systems, and ensuring systems were robust and not vulnerable to such attacks,” said information Commissioner Elizabeth Denham.

“Carphone Warehouse should be at the top of its game when it comes to cyber-security, and it is concerning that the systemic failures we found related to rudimentary, commonplace measures.”

The watchdog’s investigation found that intruders were able to access the data using valid logjn credentials as a result of the poor security measures, which included an out of date version of the WordPress content management system (CMS).

Loading ...

Indeed, the ICO found several examples of out of date software and discovered that the company failed to carry out routine tests or purge historical data – such as payment details.

“Outsiders should not be getting to such systems in the first place,” added Denham. “Having an effective layered security system will help to mitigate any attack – systems can’t be exploited if intruders can’t get in.

“There will always be attempts to breach organisations’ systems and cyber-attacks are becoming more frequent as adversaries become more determined. But companies and public bodies need to take serious steps to protect systems, and most importantly, customers and employees.”

Carphone Warehouse has accepted the fine and will pay £320,000 once a 20 percent discount for early payment is taken into account.

“We accept today’s decision by the ICO and have co-operated fully throughout its investigation into the illegal cyberattack on a specific system within one of Carphone Warehouse’s UK divisions in 2015,” a spokesperson told Silicon.

“As the ICO notes in its report, we moved quickly at the time to secure our systems, to put in place additional security measures and to inform the ICO and potentially affected customers and colleagues. The ICO noted that there was no evidence of any individual data having been used by third parties.

“Since the attack in 2015 we have worked extensively with cyber security experts to improve and upgrade our security systems and processes.

“We are very sorry for any distress or inconvenience the incident may have caused.”

Data breaches have affected a number of online retailers in the past and they could be subject to larger fines in the future once the EU’s GDPR legislation comes into force in 2018. GDPR will become UK law before Brexit and firms could face fines of up to £17 million or four percent of global turnover if adequate measures are not taken.

Take our hacking quiz here!

Steve McCaskill

Steve McCaskill is editor of TechWeekEurope and ChannelBiz. He joined as a reporter in 2011 and covers all areas of IT, with a particular interest in telecommunications, mobile and networking, along with sports technology.

Recent Posts

NHS Challenged Over Data Contract With Palantir

Contract between NHS and data mining firm Palantir now at centre of lawsuit filed by…

14 mins ago

California Can Enforce Its Own Strict Net Neutrality Law

Open Internet Victory? Ruling from US federal judge rejects attempt by US broadband providers to…

1 hour ago

Australia Passes Amended ‘Media Bargaining Law’

Australia becomes first country in the world where a government arbitrator can set prices tech…

4 hours ago

Facebook Oversight Board Confirms Appeal Over Trump Ban

Unnamed 'user' files appeal with Facebook's Supreme Court (the Oversight Board) against the 'indefinite' ban…

5 hours ago

Facebook To Invest $1 Billion In News Industry

After the very public row with the Australian government, Facebook confirms it is investing $1…

23 hours ago

EU Opens Consultation On Gig Economy Worker Rights

After UK's top court rules Uber drivers are workers, European Commission begins consultation on gig…

1 day ago