Carphone Warehouse fined £400,000 over data breach

Carphone Warehouse has been fined £400,000 by the Information Commissioner's Office (ICO) after a data breach in 2015.

Hackers gained unauthorised access to the personal data of more than three million customers and 1,000 employees during a cyber-attack.

The fine is one of the largest ever issued by the ICO.

The retailer said it accepts the ICO's findings and apologised for any distress it "may have caused".

The data breach affected Carphone Warehouse's online division, which operated the OneStopPhoneShop.com, e2save.com and Mobiles.co.uk websites.

The compromised customer data included names, addresses, phone numbers, dates of birth, marital status and, for more than 18,000 customers, historical payment card details.

The records for some Carphone Warehouse employees, including names, phone numbers, postcodes, and car registrations were also accessed.

The Information Commissioner, Elizabeth Denham, said: "A company as large, well-resourced, and established as Carphone Warehouse, should have been actively assessing its data security systems, and ensuring systems were robust and not vulnerable to such attacks.

"Carphone Warehouse should be at the top of its game when it comes to cyber-security, and it is concerning that the systemic failures we found related to rudimentary, commonplace measures."

Additional security

The final cost of the fine is expected to be £320,000, as the ICO offers a 20% discount on penalties that are paid less than a month after being issued.

The hackers, using valid login credentials, were able to access the computer system using an out-of-date WordPress software.

Affected customers and employees were informed at the time. Carphone Warehouse and the ICO have found no evidence of fraud or identity theft from the data breach.

A statement from the company said: "As the ICO notes in its report, we moved quickly at the time to secure our systems, to put in place additional security measures and to inform the ICO and potentially affected customers and colleagues.

"Since the attack in 2015 we have worked extensively with cyber security experts to improve and upgrade our security systems and processes.

"We are very sorry for any distress or inconvenience the incident may have caused."