Carphone Warehouse rocked by £400,000 ICO data fine

Carphone Warehouse has been slapped with a £400,000 fine – one of the largest issued by the Information Commissioner’s Office – after the cyber-attack of 2015 allowed unauthorised access to the personal data of nearly 3 million people, including 1,000 employees.
The compromised customer data included names, addresses, phone numbers, dates of birth, marital status and, for more than 18,000 customers, historical payment card details.
The records for some Carphone Warehouse employees, including name, phone numbers, postcode, and car registration were also accessed.
The ICO considered that the personal data involved would significantly affect individuals’ privacy, leaving their data at risk of being misused.
Information Commissioner Elizabeth Denham said: “A company as large, well-resourced, and established as Carphone Warehouse, should have been actively assessing its data security systems, and ensuring systems were robust and not vulnerable to such attacks.
“Carphone Warehouse should be at the top of its game when it comes to cyber-security, and it is concerning that the systemic failures we found related to rudimentary, commonplace measures.”
Following a detailed investigation, the ICO identified what it described as “multiple inadequacies” in Carphone Warehouse’s approach to data security and determined that the company had failed to take adequate steps to protect the personal information.
Using valid login credentials, intruders were able to access the system through out-of-date WordPress software.
The incident also exposed inadequacies in the organisation’s technical security measures. Important elements of the software in use on the systems affected were out of date and the company failed to carry out routine security testing. There were also inadequate measures in place to identify and purge historic data.
The ICO considered this to be a serious contravention of Principle 7 of the Data Protection Act 1998.
The Commissioner acknowledged the steps Carphone Warehouse took to fix some of the problems and to protect those affected. She also acknowledged that to date there has been no evidence that the data has resulted in identity theft or fraud.
However, Denham added: “The real victims are customers and employees whose information was open to abuse by the malicious actions of the intruder.
“The law says it is the company’s responsibility to protect customer and employee personal information.
“Outsiders should not be getting to such systems in the first place. Having an effective layered security system will help to mitigate any attack – systems can’t be exploited if intruders can’t get in.
“There will always be attempts to breach organisations’ systems and cyber-attacks are becoming more frequent as adversaries become more determined. But companies and public bodies need to take serious steps to protect systems, and most importantly, customers and employees.”