The successful cyberattack exposed information belonging to millions of UK customers.
Carphone Warehouse has been slapped with a £400,000 fine for a data breach which led to the theft of information belonging to millions of customers.
On Wednesday, the UK Information Commissioner’s Office (ICO) said the fine is one of the largest issued in the data watchdog’s history.
In 2015, Carphone Warehouse said that a data breach had led to the theft and exposure of sensitive, personal information belonging to up to 2.4 million customers.
However, an investigation revealed that the security incident actually allowed unauthorized access to the data of over three million customers and roughly 1,000 employees.
The names, addresses, dates of birth, marital status and historical payment card details of customers were stolen alongside the names, phone numbers, postcodes, and car registration details of staff members.
The “sophisticated cyberattack” attracted the attention of the ICO, which said, “the personal data involved would significantly affect individuals’ privacy, leaving their data at risk of being misused.”
According to the agency, the UK mobile device retail giant’s approach to data security was inadequate and Carphone Warehouse had failed to take “adequate steps” to protect data — a serious breach of the Data Protection Act of 1998.
The data breach occurred as the cyberattackers were able to obtain login credentials through WordPress software which was not kept up-to-date and patched against vulnerabilities.
Carphone Warehouse also failed to keep other software up-to-date and did not carry out regular security tests. The company also did not identify and purge historic data properly — which means that the firm may have kept information on file without cause.
“A company as large, well-resourced, and established as Carphone Warehouse, should have been actively assessing its data security systems, and ensuring systems were robust and not vulnerable to such attacks,” said Information Commissioner Elizabeth Denham. “Carphone Warehouse should be at the top of its game when it comes to cybersecurity, and it is concerning that the systemic failures we found related to rudimentary, commonplace measures.”
There have been no reported cases of customer or staff information sales or abuse to date and the company has fixed “some” of the problems highlighted by the ICO.
However, with data protection regulations set to become tougher in the UK with the introduction of the General Data Protection Regulation (GDPR), which requires protection by design, Carphone Warehouse — and every other company in the country — will need to do better than fix “some” problems to avoid future fines.
“There will always be attempts to breach organizations’ systems and cyber-attacks are becoming more frequent as adversaries become more determined,” Denham added. “But companies and public bodies need to take serious steps to protect systems, and most importantly, customers and employees.”
From:http://www.zdnet.com/article/carphone-warehouse-fined-400000-over-2015-data-breach/
About OsMonitor:
The mission of OsMonitor is to create a Windows computer system tailored for work purposes, effectively regulating employee computer behavior. It enables employers to understand what employees are doing each day, monitoring every action, including screen activity and internet usage. Additionally, it restricts employees from engaging in specific activities such as online shopping, gaming, and the use of USB drives.
OsMonitor, designed purely as software, is remarkably user-friendly and requires no additional hardware modifications. A single management machine can oversee all employee computers. As a leading brand in employee computer monitoring software with over a decade of successful operation, OsMonitor has rapidly captured the global market with its minimal file size and excellent cost-effectiveness compared to similar software. At this moment, thousands of business computers worldwide are running OsMonitor daily.
