Carphone Warehouse has been fined £400,000 by the Information Commissioner’s Office for a series of “systemic failures” uncovered following a data breach in 2015.

The ICO described the “number of distinct and significant inadequacies in the security arrangements” of Carphone Warehouse as “striking”, and said that it was “ particularly concerning that a number of the inadequacies related to basic, commonplace measures”.

The fine, one of the largest ever issued by the ICO and the same amount as the fine given to TalkTalk in 2016, came after a hacker managed to access the personal data of more than three million customers and 1,000 employees, including credit card details, names, addresses and phone numbers.

During the investigation that followed, the ICO discovered 11 separate issues with the company’s data protection and security practices, any of which would have breached the Data Protection Act on their own.

“A company as large, well-resourced and established as Carphone Warehouse should have been actively assessing its data security systems, and ensuring systems were robust and not vulnerable to such attacks,” the Information Commissioner Elizabeth Denham said.

“Carphone Warehouse should be at the top of its game when it comes to cybersecurity, and it is concerning that the systemic failures we found related to rudimentary, commonplace measures.”

Among the failures the ICO identified in Carphone Warehouse’s information security were: the use of important elements of software which were “many years out of date”, having last been updated six years before the attack; the lack of “rigorous controls” over who had login details to the system; an absence of any antivirus software running on the servers that held the data; the same root password being used on every individual server, which was known to “some 30-40 members of staff”; and storing full credit card details with “no good reason” to do so.

In a statement, Carphone Warehouse said: “We accept today’s decision by the ICO and have co-operated fully throughout its investigation into the illegal cyber-attack on a specific system within one of Carphone Warehouse’s UK divisions in 2015.

“As the ICO notes in its report, we moved quickly at the time to secure our systems, to put in place additional security measures and to inform the ICO and potentially affected customers and colleagues. The ICO noted that there was no evidence of any individual data having been used by third parties.”

Click HERE to read the original article.