Virgin Media has been given four weeks to admit liability for a major data breach, which left customers’ details freely accessible in an online database for ten-months, or face court action from customers which it is claimed could cost the business up to £4.5bn.
The incident, which occurred between April 2019 and February 2020, hit over 900,000 customers. At the time, Virgin insisted that only name, home and email address and phone numbers, technical and product information, and in some cases date of birth, had been compromised.
However, the security firm which uncovered the issue said that, as well as contact details, it had found requests to block or unblock various pornographic, gore related and gambling websites, corresponding to full names and addresses and IMEI numbers associated with stolen phones.
It also discovered subscriptions to the different aspects of Virgin Media services, including premium components; the device type owned by the user, where relevant; the “referrer” header taken users’ browser, containing details on the previous website that the user visited before accessing Virgin Media; and form submissions by users from their website.
The details were accessed by an unknown third party at least once with the majority of victims being customers with TV or telephone landline accounts, while a smaller percentage of Virgin Mobile customers were also affected.
Virgin Media blamed the error on the negligence of a staff member who did not follow correct procedures.
If Virgin Media does not admit liability then legal firm Your Lawyers intends to file an application for a Group Litigation Order (GLO) in order to formalise the action. Your Lawyers already represents almost 2,000 claimants in the case, having received thousands of enquiries, and insists claimant numbers will continue to rapidly grow.
The law firm estimates that each victim of the breach could be eligible for up to £5,000 compensation for financial and emotional distress suffered. This could leave Virgin Media with a total compensation bill of up to £4.5bn.
Your Lawyers director Aman Johal said: “Our Group Action Claim against Virgin Media is now live and I encourage anyone affected to sign up for representation now.
“Unbelievably, Virgin Media failed to take the necessary steps to keep people’s data safe for a sustained period of time, and, shockingly, it took a third-party security researcher to identify the issue.
“We know from experience that, when personal data is exposed online, it leaves victims vulnerable to cyberattacks and attempts at fraud, such as phishing scams. Customers will no doubt have bought into the Virgin Media brand that has been nurtured by Richard Branson for years and will rightly expect their personal data be properly protected. For this to have happened is an inexcusable breach of consumer rights.
“Your Lawyers will hold Virgin Media to account for this avoidable breach of private information, and we will do everything possible to ensure justice for the victims prevails. The door is open for victims to join the action, and now is the time to act.”
Related stories
We can screw Virgin Media for billions, claims law firm
Virgin Media customers urged to join data breach action
Virgin accused of covering up full extent of data breach
Oops we did it again: Virgin Media gaffe hits 900,000
‘Schoolboy error’ condemns Virgin Media data yet again
Virgin Media shoots itself in foot over phishing attack
Virgin Media in dock again as it cuts off ‘dead customer’
Scammers access Virgin Media data for phishing attack
