Dixons Carphone suffers cyber attack on customer data

LONDON: British mobile phone and electrical retailer Dixons Carphone has become the victim of a major cyber attack for the second time in three years after discovering unauthorized access to its payment card data. Shares in Dixons Carphone, which issued a profit warning last month, fell as much as 6.4 percent yesterday, taking year-on-year losses to 37 percent. “We have taken action to close off this access and have no evidence it is continuing. We have no evidence to date of any fraudulent use of the data as result of these incidents,” the company said.

It said an investigation, which started last week, indicated there was an attempt, going back to July last year, to compromise data on 5.9 million credit cards in one of the processing systems of Currys PC World and Dixons Travel stores. It said 5.8 million of these cards had chip and pin protection and the data accessed contained neither pin codes, card verification values nor any authentication data that would enable cardholder identification or purchases to be made.

However, it said 105,000 non-EU issued payment cards which do not have chip and pin protection had been compromised. Dixons Carphone said it had immediately notified the relevant card companies so that they could protect customers. It said it had found no evidence of any fraud on these cards as a result of this incident.

The group said it had also found that 1.2 million records containing non-financial personal data, such as names, addresses or email addresses, had been accessed. It said there was no evidence of fraud here either. Dixons Carphone informed Britain’s data protection regulator the Information Commissioner’s Office (ICO), as well as the Financial Conduct Authority (FCA) and the police.

The ICO said it was liaising with the National Cyber Security Centre, the FCA and other agencies to determine the impact on customers. The group’s Carphone Warehouse division suffered a data breach in 2015 and in February this year was fined a record matching 400,000 pounds ($533,240) by the ICO. It paid 320,000 pounds as there was a 20 percent reduction for early payment. It said since the 2015 attack it had worked extensively with cyber security experts to upgrade its security systems. In 2016 the ICO fined broadband provider TalkTalk 400,000 pounds for security failings that allowed hackers to launch a cyber-attack in 2015. ‘Disappointed and sorry’

“We are extremely disappointed and sorry for any upset this may cause,” Dixons Carphone CEO Alex Baldock said. “The protection of our data has to be at the heart of our business, and we’ve fallen short here.” Baldock joined Dixons Carphone in April and last month the group warned on profits and said it would have to close shops, wiping more than 500 million pounds off its stock market value. Russ Mould, investment director at AJ Bell, said the cyber attack could undermine consumer confidence in the retailer.