The company has described the breach as a “sophisticated cyber-attack.” Hackers have stolen the names, bank account details and addresses of customers. They might have also stolen credit card information for an additional 90,000 customers.
The attack took place almost two weeks before the company came to know about it on Wednesday. The Information Commissioners’ Office along with The Metropolitan Police are conducting investigations.
The mobile phone giant could face a penalty amounting to almost £500,000 upon being found guilty of not providing adequate protection to customers.
In 2011, Sony faced a penalty of £250,000 after the hacking of its PlayStation customers’ personal data.
Carphone Warehouse has also aroused the ire of its customers as the company started contacting consumers only three days post the breach came to light.
The mobile giant said in its defense that the delay in contacting took place because the I.T. team was vigorously trying to work out who the affected customers were.
Consumer groups are also criticizing the company for contacting customers over email and not by sending a text message. Customers might not check their emails because of the weekend. Therefore, a text message would have been necessary under the circumstances.
Consumer Action Group’s, Marc Gander, said, “This is appalling. Considering Carphone Warehouse is a mobile phone company, it is within their means to send text messages.”
Carphone Warehouse verified the hacking of service providers Talk Mobile, iD Mobile and TalkTalk Mobile. Hackers have also targeted e2save.com, Mobiles.co.uk and OneStopPhone.com websites.
The company has not yet commented on the identity of the hackers. It has also not talked about the location from which the attack originated.
Carphone Warehouse, however, said that the company has taken additional I.T. measures to prevent such attacks. It has also recruited a firm specializing in cyber-security to look into how the hackers managed the break-in.
The company said that it has not yet decided whether to compensate customers for this or not.
