Virgin Media data breach leaves 900,000 customers exposed

The company says that the data for customers was left unsecure online for 10 months

Virgin Media has apologised for a data breach that has seen the details of 900,000 customers accessed.

The database did not include passwords or financial details. However, it did contain limited contact information such as names, home and email addresses and phone numbers.

The database was accessed on at least one occasion, but Virgin Media does not know the extent of the access or if any information was actually used.

The breach occurred because one of its marketing databases was “incorrectly configured” which allowed unauthorised access.

Access to this database, which has been left unsecured since April 2019, was immediately shut down.

Virgin says it has contacted all affected customers and has informed the Information Commissioner’s Office.

A Virgin spokesperson says in a statement: “Our investigation is ongoing and we have contacted affected customers and the Information Commissioner’s Office.

“We take our responsibility to protect personal information seriously. We know what happened, why it happened and as soon as we became aware we immediately shut down access to the database and launched a full independent forensic investigation.”

Virgin has warned customer about the risks of identity theft and phishing. It says that if anyone has been a victim of identity theft they should contact Action Fraud.

Ernest Doku, telecoms expert at Uswitch.com, says: “Almost a million Virgin Media customers will be rightly concerned to learn that their personal data has been accessible and unsecure since last summer.

“10 months is a long time for information useful to scammers, like phone numbers and email addresses, to be left available online.

“While it’s fortunate that only one ‘unknown user’ accessed the information in that time, it only takes one person to sell that information to cyber-criminals.

“Virgin Media will undoubtedly review its policies to make sure that this doesn’t happen again, and reassure its customers that their data is safe.

“If you have been affected by this data breach, be wary of any emails from unexpected sources, and never click on any links in messages that you aren’t 100% confident about.”

How to protect yourself from phishing attacks

Scammers use emails and text messages to trick you into giving out your information. 

Always question unsolicited requests for your personal or financial information, and never click on the links and attachments in emails or texts you receive out of the blue.

Don’t assume a phone call or email is authentic. Phishing emails or texts will often look like they are from a real company that you know or trust.

Just because someone knows your basic details (such as your name or address), it doesn’t mean they are genuine. Criminals can easily spoof the phone numbers and email addresses of companies you know and trust.

If you have been a victim of a phishing scam you should change all of your passwords immediately. The strongest passwords also contain a mixture of capital and lower-case letters, numbers and symbols.

If you have been a victim of fraud or cyber-crime you can report it to Action Fraud online or by calling 0300 123 2040.