Butlin's data hack: up to 34,000 guest details may have been stolen

https://www.theguardian.com/technology/2018/aug/10/butlins-data-hack-guest-details-stolen

Version 1 of 2.

Butlin’s has said up to 34,000 guest records may have been accessed by hackers.

The holiday camp firm said the customer data at risk included names, home addresses, email addresses and phone numbers, but that payment details were secure.

The incident has been reported to the Information Commissioner’s Office (ICO). The firm is contacting people who may have been affected to inform them and tell them what they should do.

Butlin’s said its own investigations had not found any fraudulent activity related to the data breach.

People who believe they may have been affected should be cautious about giving any additional details when contacted by individuals purporting to be from the leisure company.

Butlin’s managing director, Dermot King, said: “Butlin’s take the security of our guest data very seriously and have improved a number of our security processes. I would like to apologise for any upset or inconvenience this incident might cause.

“A dedicated team has been set up to contact all guests who may be affected directly. I would like to personally reassure guests that no financial data has been compromised.”

Meanwhile, Liverpool football club is writing to a group of supporters who used online ticketing services or telephone sales in 2012 to advise them to change their password after “unauthorised external access to an employee account”.

The club has reset the online ticketing passwords for fans and is recommending other steps to a wider group.

It said there was no evidence that any supporter accounts had been accessed and no financial information was involved.

A number of large companies in Britain have been targeted by hackers in recent years.

Carphone Warehouse was fined £400,000 by the ICO in January for a series of “systemic failures” uncovered after a data breach in 2015.

The fine, one of the largest ever issued by the ICO and the same as the fine given to TalkTalk in 2016, came after the personal data of more than 3 million customers and 1,000 employees, including credit card details, names, addresses and phone numbers, was accessed.

During the investigation, the ICO discovered 11 separate issues with the company’s data protection and security practices that would have breached the Data Protection Act on their own.

In May, Grant West, 26, who carried out cyber-attacks on companies including Sainsbury’s, Asda, Uber, Argos, Ladbrokes and Coral before selling customers’ data on the dark web, was jailed for more than 10 years.

He obtained the email addresses of more than 160,000 people and sent them phishing scams masquerading as the online food order and delivery service Just Eat to get their personal data.

West, who used the online identity “Courvoisier”, sold the information on the dark web, stashing his £1.6m profits in online caches of bitcoin.

Data and computer security

Travel & leisure

Consumer affairs

news

Share on Facebook

Share on Twitter

Share via Email

Share on LinkedIn

Share on Pinterest

Share on WhatsApp

Share on Messenger

Reuse this content