Carphone Warehouse Data Breach â A Personal Experience

The personal information of 2.4 million customers of Carphone Warehouse and its related brands have been stolen in a cyber-attack, it emerged last weekend.

According to various accounts, the attack was discovered on Wednesday 5th August, and affected customers notified 3 days later on the Saturday. The news then broke rapidly across the UK news media.

The company says it wrote directly to all affected customers, and the Information Commissioners Office has said it will launch an investigation.

However, this story has a personal angle for me, which I think highlights some of the issues around how such events are communicated.

I’m a Carphone Warehouse customer, I bought a phone contract from them two years ago, which was recently renewed through their related brand, Talk Mobile. I didn’t get an email from Carphone Warehouse, but by coincidence I saw the story when it first broke on the BBC on Saturday morning. At that time the story mentioned that customers with Talk Mobile may also have been affected.

About an hour after the story broke I got onto the Talk Mobile website, and there was no information about the breach. I then contacted customer support via an online chat service. They had clearly not been told and knew nothing about the breach. I got a standard line about how they take security very seriously and my information was perfectly safe. I changed my password.

I monitored the website over the weekend but it was not until Monday that any information was published. At least it was prominent on the home page – unlike the Carphone Warehouse site which buried it in the News section.

However the messaging here was not altogether re-assuring either. It stated that ‘attempts’ were being made to contact customers, and if I ‘don’t hear’ anything I’m OK. However it gave no indication of when I might have expected to hear – so now I am in limbo.

My best guess is that I probably haven’t had my data stolen on this occasion, and of course I am happy about that. But I am not happy that I have to rely on that best guess. My trust in the company, such as it was, has been diminished because I feel as if I have no meaningful re-assurance of safety. I would have felt much more confident if I had received a direct message that told me:

a) The breach took place,
b) but my data was not lost.

It may be that they can’t be sure about b) yet, so they can’t tell me that, but I still feel left in the dark. Data breach notification is difficult, investigations and decisions have to be made in a fast moving environment. I know this. I also know that the priority has to lie with those people who definitely have had their information compromised.

However, this is more than just about compliance, it is about much broader brand damage limitation. In that context, some kind of direct message to me as a customer, even to tell me I’m probably not at risk would have been very reassuring. Anything really would be good. I don’t think you can over-communicate in a situation like this.

This is doubly important because of the data they hold about me. Personal information I cannot change but which exposes me to identity theft if it has been lost.

Maybe the thieves did get it, but somehow I got missed off the communication list? That can easily happen, especially when communicating in a crisis situation.

Carphone Warehouse may not have lost my information, and I will probably never know, but they have certainly lost my trust. Simply by failing to acknowledge me as a customer at a time of uncertainty.

Only time will tell if they will try to restore it again before I can leave them for someone else.