Carphone Warehouse has been fined £400,000 after the retailer’s “serious failings” placed the personal data of millions of customers at risk.
The company was issued with the fine after one of its computer systems was compromised as a result of a cyber-attack in 2015.
According to the Information Commissioner’s Office (ICO), the organisation’s failure to secure the system allowed unauthorised access to data belonging to over three million customers and 1,000 employees.
It included names, addresses, phone numbers, dates of birth, marital status and – for more than 18,000 customers – historical payment card details.
“A company as large, well-resourced, and established as Carphone Warehouse, should have been actively assessing its data security systems, and ensuring systems were robust and not vulnerable to such attacks,” said information commissioner Elizabeth Denham (pictured below)
“Carphone Warehouse should be at the top of its game when it comes to cyber-security, and it is concerning that the systemic failures we found related to rudimentary, commonplace measures.”
Following a detailed investigation, the ICO identified multiple inadequacies in Carphone Warehouse’s approach to data security and determined that the company had failed to take adequate steps to protect the personal information.
Using valid login credentials, intruders were able to access the system through an out-of-date WordPress software.
The incident also exposed inadequacies in the retailer’s technical security measures. Important elements of the software in use on the systems affected were out of date and the company failed to carry out routine security testing. There were also inadequate measures in place to identify and purge historic data.
However, Denham acknowledged the steps Carphone Warehouse took to fix some of the problems and to protect those affected.
She also acknowledged that there has been no evidence that the data has resulted in identity theft or fraud.
“The real victims are customers and employees whose information was open to abuse by the malicious actions of the intruder,” Denham said.
“There will always be attempts to breach organisations’ systems and cyber-attacks are becoming more frequent as adversaries become more determined.
“But companies and public bodies need to take serious steps to protect systems, and most importantly, customers and employees.”
TalkTalk was fined £400,000 in 2016 after hackers breached the accounts of 157,000 customers.