Commercial Client

Company Data Breaches Lead to £150,000 Fine

A company which failed to take adequate steps to secure its website against hackers has been hit with a £150,000 financial penalty after a malicious fraudster managed to download personal data relating to its customers, including more than a million credit and debit card records.

The company acted as data controller for a wholly-owned subsidiary which traded as a booking agent for airport car parking. Although the website was linked to a system used to store large amounts of personal data, it was remotely accessible via a login page to make it easier for staff working from home. The website was for internal use, not ‘customer-facing’, but its login page contained a coding error which rendered it acutely vulnerable.

A hacker found his way past what security there was and extracted a huge volume of personal data, including customer names, addresses, telephone numbers, email addresses and 1,163,996 credit and debit card records. Anti-virus software eventually sounded the alarm and the website was shut down.

In imposing the financial penalty, the Information Commissioner’s Office (ICO) noted that no checks on the website’s security had been carried out, opening the way for the hacker to exploit its vulnerability. The risk created by the failure to install suitable safeguards ‘should have been obvious’ and, although there was no evidence of the hacked data having been used to successfully perpetrate fraud, the security lapse had caused substantial distress to customers.

The company had voluntarily notified the incident to the ICO and had co-operated fully with the investigation. Nevertheless, the penalty was appropriate to mark the company’s ‘very serious’ failure to meet its obligations under the Data Protection Act 1998. The maximum penalty which can be imposed for breaches of the Act is £500,000.


Return to Lists

News

Company Data Breaches Lead to £150,000 Fine

Fri, 27 Mar 2015

Offensive Tweets and Unfair Dismissal

Mon, 23 Mar 2015

Fencing Disrepair Blocks Lease Termination

Fri, 20 Mar 2015

Increases in the National Minimum Wage

Tue, 17 Mar 2015

Misled Directors Earn Rights in Company

Tue, 17 Mar 2015

Refusal to Mediate Justified, Rules Court

Mon, 16 Mar 2015

Contractor Liable When Shoddy Work Makes Flats Unfit for Human Habitation

Mon, 16 Mar 2015

Overdue VAT? HMRC Can Wind Up Your Company

Mon, 16 Mar 2015

When is a Teacher Not a Teacher? High Court Rules

Mon, 16 Mar 2015

Court Interpreters' Race Discrimination Claims Boosted

Mon, 16 Mar 2015

Deals

26/03/2015 Kerman & Co advise on sale of BB's Coffee & Muffins
08/03/2015 Kerman & Co. advises the shareholders of CloserStill on a 4th round of Private Equity investment
24/02/2015 Kerman & Co advises LGO Energy plc on its US$25 million long-term oil swap agreement with BNP Paribas
More >

Contact us

Head Office   Dublin Office

Kerman & Co. LLP
200 Strand,
London,
WC2R 1DJ

Tel: 020 7539 7272
Fax: 020 7240 5780
DX: 99 Chancery Lane
[email protected]

 

Kerman & Co. Solicitors,
Fitzwilliam Hall,
Fitzwilliam Place,
Dublin 2

Tel: 01 9011 115
Fax: 01 6694 798
DX: 99 Dublin
[email protected]