Compromise of a member organisation’s database [30/05/2011]

In 2010 my Office investigated a data breach incident involving personal data of members of a large member organisation. In the course of the incident a database was compromised that contained the names and addresses of 500,000 members, the dates of birth of 289,000 members, mobile phone numbers for 107,000 members, landline numbers for 64,000 members and email addresses for 30,000 members (all numbers are approximate).  In the case of 544 members, the database contained references to medical conditions.  The database was hosted by Company X, a service provider contracted by the organisation.  Company X confirmed that unauthorised access was gained to the database.  At time of writing, this access is the subject of an ongoing criminal investigation by the Police Service of Northern Ireland (PSNI).

My Office received full co-operation from the organisation in question during the course of our investigation.  The organisation informed all its branches of the incident and put in place a dedicated information line for any members with concerns or who wished to establish whether their data was involved.  The organisation wrote directly to any person whose health data was affected.  As the incident has a cross-border element, we continue to liaise closely with our colleagues in the Information Commissioner's Office in Belfast as well as the PSNI. 

The database in question was established to ensure a safe means of transmitting membership data.  Unfortunately, in this case, it serves to illustrate the vulnerability of large centralised databases to inappropriate access.  We sought to reassure those affected that there was no evidence that the data in question would be used for an illegal purpose or could be used to perpetrate identity theft on its own.  However, affected members should continue to be cautious in relation to any unsolicited contacts they receive through the post, over the phone or particularly via email that refer to their membership of that organisation and that seek to elicit further personal information.