Carphone Warehouse fined £400,000 for data breach

Hackers gained unauthorised access to the personal data of more than three million customers and 1,000 employees during a cyber attack. 

The breach affected the retailer’s online division, which included the OneStopPhoneShop.com, e2save.com and Mobiles.co.uk websites.

Compromised data included names, addresses, phone numbers and – for more than 18,000 customers – payment card details. Records for 1,000 Carphone Warehouse employees were also accessed.

Information commissioner Elizabeth Denham said: “A company as large, well-resourced, and established as Carphone Warehouse, should have been actively assessing its data security systems, and ensuring systems were robust and not vulnerable to such attacks.

“Carphone Warehouse should be at the top of its game when it comes to cyber-security, and it is concerning that the systemic failures we found related to rudimentary, commonplace measures.”

The Dixons Carphone-owned mobile phone specialist said it accepts the ICO’s findings and apologised for any distress it “may have caused”.

In a statement, the retailer said: “As the ICO notes in its report, we moved quickly at the time to secure our systems, to put in place additional security measures and to inform the ICO and potentially affected customers and colleagues.

“Since the attack in 2015 we have worked extensively with cyber security experts to improve and upgrade our security systems and processes.”

Affected customers and employees were informed at the time and Carphone Warehouse and the ICO have found no evidence of fraud or identity theft from the data breach.

The fine is one of the largest ever issued by the ICO and comes at a bad time for the electricals giant which reported plunging interim profits at the end of last year.

It is in the process of remodelling its mobile phones division in order to reduce the complexity and capital intensity of it and to maintain relevance in the changing UK mobile phone market.