Anatomy of a Breach

Anatomy of a Breach: Carphone Warehouse — 2.4 Million Customers and an ICO £400,000 Fine

> series: anatomy_of_a_breach —— part: 081 —— target: carphone_warehouse —— customers: 2,400,000 —— fine: £400,000<span class="cursor-blink">_</span>_

Hedgehog Security 30 September 2015 12 min read

2.4 million UK customers. Outdated software. £400,000 ICO fine.

On 8 August 2015, Carphone Warehouse disclosed that a cyber attack on a division running its online services — OneStopPhoneShop.com, e2save.com, and Mobiles.co.uk — had potentially compromised the personal data of up to 2.4 million customers and 90,000 encrypted credit card records. The stolen data included names, addresses, dates of birth, and bank details. The attack had been discovered on 5 August, approximately two weeks after the initial intrusion.

The ICO's investigation found systemic security failings: the company was running outdated WordPress software with known vulnerabilities, had not conducted adequate security testing, lacked a Web Application Firewall, and did not have rigorous enough security measures in place. The ICO fined Carphone Warehouse £400,000 — its largest fine at the time — and the enforcement notice read like a catalogue of basic security controls that should have been in place but were not. Every failing identified by the ICO would have been found by a routine web application penetration test.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Every failing was basic, known, and preventable.

Outdated WordPress Installation
The compromised systems ran outdated WordPress software with known vulnerabilities. WordPress patching is one of the most basic security hygiene requirements — and one that <a href="/cyber-essentials">Cyber Essentials Danzell</a> mandates with its 14-day patching window. Our <a href="/vulnerability-scanning">vulnerability scanning</a> identifies outdated CMS installations.
No Security Testing
The ICO found that Carphone Warehouse had not conducted adequate security testing. A single <a href="/penetration-testing/web-application">web application penetration test</a> would have identified the outdated software, the missing WAF, and the exploitable vulnerabilities before the attackers found them.
No Web Application Firewall
The absence of a WAF meant that common web attacks — SQL injection, cross-site scripting, file inclusion — had no automated defence layer. While WAFs are not a substitute for secure coding and patching, they provide defence in depth against common attack techniques.
£400,000 Fine — The ICO's Largest
The £400,000 fine was the ICO's largest at the time — a signal that the regulator was prepared to impose significant penalties for basic security failures. Under GDPR (coming in 2018), the same breach could have resulted in a fine of up to 4% of global turnover. <a href="/blog/sector-under-the-microscope-retail">Our retail sector analysis</a> examines the regulatory landscape for UK retailers.

Carphone Warehouse, TalkTalk, and the UK's recurring nightmare.

The Carphone Warehouse breach came just two months before the TalkTalk breach would dominate UK headlines — creating a one-two punch that put UK telecoms and retail security under intense public and regulatory scrutiny. Both breaches shared the same root causes: outdated software, inadequate testing, and basic security controls that had not been implemented. Both resulted in significant ICO fines. And both were entirely preventable.

For UK retailers and telecoms businesses, the message from the ICO was unambiguous: basic security failures will be punished. Cyber Essentials certification provides the framework and evidence of baseline security. Our web application testing identifies the vulnerabilities the ICO found at Carphone Warehouse. Vulnerability scanning keeps your CMS platforms patched. SOC in a Box monitors for exploitation attempts. And UK Cyber Defence provides incident response when a breach is detected.


The ICO fined Carphone Warehouse £400,000 for basic failures. Are you next?

Every failing the ICO found would have been caught by our <a href="/penetration-testing/web-application">web application testing</a>. <a href="/cyber-essentials">Cyber Essentials</a> prevents the basics. <a href="/vulnerability-scanning">Vulnerability scanning</a> keeps your platforms patched.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles