ICO fines Carphone Warehouse £400,000

The Information Commissioner’s Office (ICO) has fined Carphone Warehouse £400,000 after the personal data of three million customers and 1,000 employees was exposed in a 2015 data breach.

In October 2016, TalkTalk was also issued with a then record fine of £400,000 for the cyber attack in 2015 that exposed the personal details of more than 150,000 customers, and then, less than 10 months later in August 2017, the ICO fined the company a further £100,000 for failing to look after customers’ data.

According to the ICO, the personal data at Carphone Warehouse was exposed in a cyber attack in 2015 because of the company’s failure to protect the data from unauthorised access.

The compromised customer data included names, addresses, phone numbers, dates of birth, marital status and, for more than 18,000 customers, historical payment card details.

The records for some Carphone Warehouse employees, including name, phone numbers, postcode and car registration, were also exposed.

In determining the monetary penalty, the ICO considered that the personal data involved would significantly affect individuals’ privacy, leaving their data at risk of being misused.

Information commissioner Elizabeth Denham said that a company as large, well-resourced and established as Carphone Warehouse should have been actively assessing its data security systems and ensuring that systems were robust and not vulnerable to such attacks.

“Carphone Warehouse should be at the top of its game when it comes to cyber security, and it is concerning that the systemic failures we found related to rudimentary, commonplace measures,” said Denham.

Following a detailed investigation, the ICO identified multiple inadequacies in Carphone Warehouse’s approach to data security and determined that the company had failed to take adequate steps to protect the personal information.

Using valid login credentials, intruders were able to access the system via an out-of-date version of WordPress software.

The incident also exposed inadequacies in the organisation’s technical security measures. The ICO said important elements of the software in use on the systems affected were out of date and the company had failed to carry out routine security testing. There were also inadequate measures in place to identify and purge historic data.

The ICO said its investigation had revealed a serious contravention of Principle 7 of the Data Protection Act 1998, which requires appropriate technical and organisational measures to be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

The ICO said it acknowledged the steps Carphone Warehouse had taken to fix some of the problems and to protect those affected, and that, to date, there has been no evidence that the data has resulted in identity theft or fraud.   

According to Denham, the real victims are customers and employees whose information was open to abuse by the malicious actions of the intruder.

“The law says it is the company’s responsibility to protect customer and employee personal information,” she said. “Outsiders should not be getting to such systems in the first place. Having an effective layered security system will help to mitigate any attack – systems can’t be exploited if intruders can’t get in.

“There will always be attempts to breach organisations’ systems and cyber attacks are becoming more frequent as adversaries become more determined. But companies and public bodies need to take serious steps to protect systems and, most importantly, customers and employees.”

From 25 May this year, the law will get more stringent as the General Data Protection Regulation (GDPR) compliance deadline is reached, the ICO said.