Name, number of children, after-tax income... of 1,500 people
THE database at the centre of the data breach was first sent from New Beginning to Arizun director Ray Murphy on August 25 – the same day that New Beginning were paid €20,000 (€24,600 including VAT) by the fund.
Attached to the email was a spreadsheet called Final Master List 1500 Mortgage Samples. It includes name, adress, number of children, debts and income.
‘Can’t reach you by phone,’ it reads. ‘Trusting the new points I sent you won’t be an issue for inclusion so in the spirit of trust and in an appetite to get started – here’s the 1500 names as promised.’
The message then goes on to request payment. ‘You have a copy of the invoice. Can you lodge monies by direct transfer today as promised?’ it asks.
On September 10, two weeks after the data was first sent to Arizun, a staff member at Arizun emailed it back to New Beginning asking that a number of duplicated names be corrected.
This email stated: ‘As discussed today..., I have taken the 1500 samples you provided in relation to TSB, Ulster Bank and AIB,’ it begins.
‘We have combined them in the combined sheet in the spreadsheet,’ it continues, before going on to specify why the data must eliminate any duplications.
‘The data and research we extract will form the basis of the price that we will offer the banks for the mortgages. It will also form the basis for our models that will be scrutinised by the liquidity investors, therefore it is now a matter of urgency that we get substitutions as soon as possible,’ the email concludes.
A further email, dated September 16, suggests that three weeks after the unredacted data breach the issue had not raised any concerns at New Beginning.
In this email, sent internally, instructions are given about how to replace duplicated names. It read: ‘Each consultant is providing details of their clients whom they met with and have financial information for since August.’