Why did Carphone wait 3 days to raise alarm on data theft?
Hackers stole private details of 2.4m customers
FURIOUS customers last night asked why Carphone Warehouse waited three days before making it public that hackers had stolen the data of millions of customers.
The mobile phone retailer raised the alarm on Saturday, issuing a statement in which it said it had been the victim of a ‘sophisticated cyber-attack’.
But it later emerged its systems detected the breach on Wednesday, and the attack may have started up to two weeks earlier. Carphone Warehouse executives could now be hauled before MPs to explain how it failed to protect customers’ personal data.
The details of as many as 2.4million customers may have been accessed, including names, addresses, date of birth information and bank details.
The credit card data of 90,000 customers ‘may also have been accessed’, although this was encrypted, the firm said. Privacy watchdog the Information Commissioner’s
‘Extremely distressing’
Office – which can fine companies up to £500,000 for having inadequate data protection – is investigating.
The Treasury Select Committee could demand the boss of parent company Dixons Carphone, Eton-educated Sebastian James, answers questions on the debacle.
Mr James – a Bullingdon Club contemporary of David Cameron at Oxford University who stands to make almost £5million next year if he meets performance targets – has apologised to customers and said security has been improved.
But John Mann, a Labour member of the committee, said: ‘How many times are we going to see stories like these? Companies need to protect customers’ data, but I don’t get the impression they are. This is extremely distressing for customers.’
Asked when the data breach began, a spokesman for the firm replied: ‘The evidence indicates within the last two weeks.’
The spokesman said the attack had been stopped ‘straight away’ following its detection.
But customers vented their anger on Twitter at the threeday delay and poor communication from Carphone Warehouse.
Menna Flavell said: ‘How timely of Carphone Warehouse to delay announcement of hacking to weekend when banking services are most difficult to contact.’
The privacy watchdog said delays in informing customers about the attack could form ‘an element’ of its inquiry. The cyber attack affects online customers of several Carphone Warehouse divisions, including OneStopPhoneShop.com, e2save. com and Mobiles.co.uk.
These websites provide services for mobile phone contracts for TalkTalk Mobile, Talk Mobile and Carphone Warehouse’s new 4G iD mobile network and they are also affected. Carphone Warehouse is owned by Dixons Carphone following a merger with electrical firms Currys and PC World.
The retailer said information about Currys and PC World customers and ‘the vast majority’ of Carphone Warehouse customer data was held on separate systems and had not been affected.
Asked about the delayed public announcement, a spokesman said it had taken time to work out ‘what data had been accessed how many had been affected and who had been affected’.