1. News
January 11, 2018

ICO imposes fine on Carphone Warehouse over data breach

The UK's Information Commissioner’s Office (ICO) has imposed a £400,000 fine on mobile phone retailer Carphone Warehouse after one of its computer systems was compromised as a result of a cyber-attack in 2015.

The UK’s Information Commissioner’s Office (ICO) has imposed a £400,000 fine on mobile phone retailer Carphone Warehouse after one of its computer systems was compromised as a result of a cyber-attack in 2015.

ICO noted that the company’s failure to secure its systems has led to a data breach and enabled unauthorised users to access personal information of more than three million customers and 1,000 employees.

The compromised customer data included names, addresses, phone numbers, dates of birth, and historical card payment details of nearly 18,000 customers.

ICO has considered that the data breach would significantly affect individuals’ privacy, leaving their data at risk of being misused.

“It is concerning that the systemic failures we found related to rudimentary, commonplace measures.”

UK Information Commissioner Elizabeth Denham said: “A company as large, well-resourced, and established as Carphone Warehouse, should have been actively assessing its data security systems, and ensuring systems were robust and not vulnerable to such attacks.

“Carphone Warehouse should be at the top of its game when it comes to cybersecurity, and it is concerning that the systemic failures we found related to rudimentary, commonplace measures.”

Content from our partners
Advanced analytics and predicting market trends in FMCG
How smart predictive analytics is shaping product development
Data analysis in the brave new world

After conducting a detailed investigation, the ICO has concluded that it has noticed multiple shortfalls in Carphone Warehouse’s approach towards data security and determined that the phone retailer has not taken sufficient steps to protect the personal information of its customers and its staff members.

The ICO has considered this incident as a serious contravention of Principle 7 of the Data Protection Act 1998.

After the investigation by the ICO, the phone retailer is reported to have taken some measures to fix the loopholes in the system.

Denham further noted that there has so far been no evidence that the data breach has resulted in identity theft or fraud.

From 25 May, the UK Government is planning to implement General Data Protection Regulation (GDPR), a new law which states that companies and public bodies should ensure strong IT governance and information security measures are in place.