Fans claim West Ham have shared their data

West Ham United could face a data breach investigation over allegations staff twice shared personal details of hundreds of season ticket holders in a round-robin email.

Angry fans took to Twitter last night to complain that their names were among up to 200 email addresses on a blanket message sent out to confirm tickets for next week’s League Cup tie at AFC Wimbledon.

It is claimed that the club then sent out an apology but repeated their same mistake by listing in carbon copy (CC), instead of transferring them to BCC.

One supporter, Nick Marsh, wrote on Twitter: “West Ham sharing 500-odd email addresses. Tried to rectify it, and in doing so shared the addresses again. Typical West Ham. Shambles.”

The Daily Telegraph understands West Ham have apologised to the supporters involved and will report the incident to the Information Commissioner’s Office today.

Ben Robson, a partner at legal firm Oury Clark, said the breach was a potentially notifiable issue for the ICO. “This would be a data breach because the purpose supporters gave their addresses to West Ham was not for it to be shared with every Tom, Dick or Harry,” he said. “Given the scale, it’s certainly the kind of thing that is notifiable. It’s a pretty large-scale breach for anyone wanting to use the list for their own personal devices.”

Another Twitter user, Jack Lebeau, wrote: “West Ham’s email to away season ticket holders confirming their ticket for Wimbledon has cc’d in every single person who has got the ticket. Massive data breach for a top PL club. Fine can be up to 4 per cent of annual income. Hugely embarrassing for club.”

West Ham have not yet replied to a request by The Daily Telegraph to comment. The apparent bungle comes as the club are in a dispute with the owners of the London Stadium after the venue’s owners refused to reinstate the club’s honours board because of what they claim are unpaid bills.