Anatomy of a Breach

Anatomy of a Breach: Zurich Insurance UK — A Lost Backup Tape and a £2.28 Million Fine

> series: anatomy_of_a_breach —— part: 020 —— target: zurich_insurance_uk —— records: 46,000 —— fine: £2,280,000<span class="cursor-blink">_</span>_

Hedgehog Security 31 August 2010 12 min read

46,000 customers. An unencrypted tape. Lost in transit.

In August 2008, Zurich Insurance UK lost a backup tape containing the personal details of approximately 46,000 general insurance customers during a routine data transfer to a data centre in South Africa operated by a third-party outsourcer. The tape was unencrypted. It was never recovered. Two years later, in August 2010, the Financial Services Authority (FSA, now the FCA) fined Zurich Insurance £2.28 million — at the time, one of the largest data protection fines ever imposed by a UK financial regulator.

The compromised data included customer names, addresses, dates of birth, and — for some customers — bank account details, credit card information, and insurance policy details. The FSA's investigation found that Zurich had failed to have adequate systems and controls to prevent the loss of customer data, failed to ensure that the outsourcer had adequate data security arrangements, and failed to adequately oversee the outsourced data management process. The fine was particularly significant because it was imposed by a financial regulator — not the ICO — signalling that data security failures in financial services would be treated as regulatory compliance failures, not just data protection issues.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Outsourcing the process, not the risk.

No Encryption on Backup Media
The backup tape was unencrypted. Encryption of data in transit and at rest — especially on portable media — is a fundamental control. Our <a href="/penetration-testing/infrastructure">infrastructure assessments</a> verify that backup media is encrypted, and <a href="/cyber-essentials">Cyber Essentials</a> requires encryption as a baseline control.
Inadequate Third-Party Oversight
Zurich outsourced the data management to a third party but did not ensure that the outsourcer had adequate security controls. The FSA was explicit: outsourcing a business process does not outsource the regulatory obligation. Our <a href="/blog/sector-under-the-microscope-financial-services">financial services sector analysis</a> examines third-party risk management as a critical concern.
Insecure Data Transfer
Physical backup tapes were shipped internationally without tracking, encryption, or chain-of-custody procedures. The same systemic failure we saw in the <a href="/blog/anatomy-of-a-breach-hmrc-child-benefit-data-loss">HMRC breach</a> — sensitive data on physical media, transported without adequate protection.
Two-Year Delay in Disclosure
The tape was lost in August 2008; the FSA fine was not imposed until August 2010. The delay in identifying, reporting, and resolving the breach extended the period during which affected customers were at risk without knowledge.

When the FCA treats data loss as a regulatory failure.

The Zurich fine was significant because it came from the FSA (now FCA), not the ICO. This established the principle that data security failures in financial services are treated as regulatory compliance failures under the FSA's principles for business — specifically Principle 3 (management and control) and the requirement for firms to take reasonable care to organise and control their affairs responsibly. For FCA-regulated firms today, data security failures can result in enforcement action from both the FCA and the ICO — and under SMCR, individual senior managers can be held personally accountable.

Our financial services sector analysis covers these regulatory obligations in detail. For FCA-regulated firms, penetration testing and Cyber Essentials certification provide the evidence of security investment that regulators expect. SOC in a Box for Financial Services provides the continuous monitoring that detects data loss in real-time. And UK Cyber Defence provides the incident response capability that regulatory obligations require.


The FCA fines data security failures. Are you compliant?

Our <a href="/penetration-testing">penetration testing</a> and <a href="/cyber-essentials">Cyber Essentials certification</a> provide the evidence that FCA-regulated firms need. <a href="https://www.socinabox.co.uk/sectors/ifas-wealth-managers">SOC in a Box</a> provides continuous monitoring. Because in financial services, a data breach is not just a security incident — it is a regulatory event.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles