Almost a million Virgin Media customers had their personal details stored on a marketing database that had been left unsecured since last April, the company has admitted.
Records show that the database has been accessed by at least one person from outside the company, Virgin Media said, although it does not yet have any evidence that the information has been used illegally.
No financial details were stored in the database, nor passwords. But it did contain contact details (such as name, home and email address and phone numbers) for users, as well as technical and product information about some of their devices. The company said it has contacted all 900,000 of the affected individuals and told the Financial Times that they make up about 15% of its fixed-line customer base.
“Our investigation is ongoing and we have contacted affected customers and the Information Commissioner’s Office,” Virgin Media said in a statement. “We take our responsibility to protect personal information seriously. We know what happened, why it happened and as soon as we became aware we immediately shut down access to the database and launched a full independent forensic investigation.”
The company warned customers that they may be victims of identity theft as a result of the stolen personal details, and advised concerned customers to contact Action Fraud if they think they have been targeted. The information would also be useful to would-be scammers planning to carry out phishing attacks or fraudulent phone calls, in the hope that they could convince their targets that they are the legitimate representatives of Virgin Media.
Adam French, consumer right expert at Which?, said: “This data breach has exposed the data of almost a million Virgin Media customers and whilst no financial details or passwords were included, those customers are likely to be worried. It is vital that Virgin Media continues to provide clear information on what has happened.
“For anyone concerned they could be affected – it’s good practice to update your password after a data breach. Also, be wary of emails regarding the breach, as scammers may try and take advantage of it.”
Accidental exposure is a common form of data breach, particularly as companies move increasing amounts of valuable information to cloud computing providers such as Google and Amazon. A simple misconfiguration can result in supposedly internal data being exposed to the wider internet as a result, with many would-be attackers regularly scanning for newly exposed “buckets” to see whether they contain valuable data such as personal information or passwords.
