ICO Dishes £400,000 Fine To Carphone Warehouse For 2015 Data Breach

Carphone Warehouse has been fined £400,000 for a 2015 cyberattack that saw the personal details of more than three million customers and 1,000 employees exposed to criminals.

The penalty is one of the largest ever dished out by the Information Commissioner’s Office (ICO) and reflects the inadequacies found in the company’s cybersecurity measures following an investigation.

The ICO said the data stolen – which included names, phone numbers, dates of birth and historical payment card details – meant customer and employee privacy was at risk.

ICO Carphone Warehouse fine

“A company as large, well-resourced, and established as Carphone Warehouse, should have been actively assessing its data security systems, and ensuring systems were robust and not vulnerable to such attacks,” said information Commissioner Elizabeth Denham.

“Carphone Warehouse should be at the top of its game when it comes to cyber-security, and it is concerning that the systemic failures we found related to rudimentary, commonplace measures.”

The watchdog’s investigation found that intruders were able to access the data using valid logjn credentials as a result of the poor security measures, which included an out of date version of the WordPress content management system (CMS).

Indeed, the ICO found several examples of out of date software and discovered that the company failed to carry out routine tests or purge historical data – such as payment details.

“Outsiders should not be getting to such systems in the first place,” added Denham. “Having an effective layered security system will help to mitigate any attack – systems can’t be exploited if intruders can’t get in.

“There will always be attempts to breach organisations’ systems and cyber-attacks are becoming more frequent as adversaries become more determined. But companies and public bodies need to take serious steps to protect systems, and most importantly, customers and employees.”

Carphone Warehouse has accepted the fine and will pay £320,000 once a 20 percent discount for early payment is taken into account.

“We accept today’s decision by the ICO and have co-operated fully throughout its investigation into the illegal cyberattack on a specific system within one of Carphone Warehouse’s UK divisions in 2015,” a spokesperson told Silicon.

“As the ICO notes in its report, we moved quickly at the time to secure our systems, to put in place additional security measures and to inform the ICO and potentially affected customers and colleagues. The ICO noted that there was no evidence of any individual data having been used by third parties.

“Since the attack in 2015 we have worked extensively with cyber security experts to improve and upgrade our security systems and processes.

“We are very sorry for any distress or inconvenience the incident may have caused.”

Data breaches have affected a number of online retailers in the past and they could be subject to larger fines in the future once the EU’s GDPR legislation comes into force in 2018. GDPR will become UK law before Brexit and firms could face fines of up to £17 million or four percent of global turnover if adequate measures are not taken.

Take our hacking quiz here!