> series: anatomy_of_a_breach —— part: 081 —— target: carphone_warehouse —— customers: 2,400,000 —— fine: £400,000<span class="cursor-blink">_</span>_
On 8 August 2015, Carphone Warehouse disclosed that a cyber attack on a division running its online services — OneStopPhoneShop.com, e2save.com, and Mobiles.co.uk — had potentially compromised the personal data of up to 2.4 million customers and 90,000 encrypted credit card records. The stolen data included names, addresses, dates of birth, and bank details. The attack had been discovered on 5 August, approximately two weeks after the initial intrusion.
The ICO's investigation found systemic security failings: the company was running outdated WordPress software with known vulnerabilities, had not conducted adequate security testing, lacked a Web Application Firewall, and did not have rigorous enough security measures in place. The ICO fined Carphone Warehouse £400,000 — its largest fine at the time — and the enforcement notice read like a catalogue of basic security controls that should have been in place but were not. Every failing identified by the ICO would have been found by a routine web application penetration test.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe Carphone Warehouse breach came just two months before the TalkTalk breach would dominate UK headlines — creating a one-two punch that put UK telecoms and retail security under intense public and regulatory scrutiny. Both breaches shared the same root causes: outdated software, inadequate testing, and basic security controls that had not been implemented. Both resulted in significant ICO fines. And both were entirely preventable.
For UK retailers and telecoms businesses, the message from the ICO was unambiguous: basic security failures will be punished. Cyber Essentials certification provides the framework and evidence of baseline security. Our web application testing identifies the vulnerabilities the ICO found at Carphone Warehouse. Vulnerability scanning keeps your CMS platforms patched. SOC in a Box monitors for exploitation attempts. And UK Cyber Defence provides incident response when a breach is detected.
Every failing the ICO found would have been caught by our <a href="/penetration-testing/web-application">web application testing</a>. <a href="/cyber-essentials">Cyber Essentials</a> prevents the basics. <a href="/vulnerability-scanning">Vulnerability scanning</a> keeps your platforms patched.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call