Virgin Media Exposed Personal Information of 900,000 People

06 March 2020

Virgin Media Exposed Personal Information of 900,000 People

UK-based phone, TV and broadband services provider Virgin Media on Thursday admitted that it exposed the personal information of roughly 900,000 people.

The company blamed the incident on a misconfigured marketing database that stored names, home addresses, email addresses, phone numbers, and technical and product information. Dates of birth were also exposed “in a very small number of cases.”

“Please note that this is all of the types of information in the database, but not all of this information may have related to you,” customers were told.

Virgin Media said the exposed database did not include any passwords or financial information, such as payment card details or bank account numbers. The database stored information on both customers and potential customers.

The firm said this was not a cyberattack and its database was not hacked. However, its investigation revealed that the database was accessed at least once, although it is unclear if any information was actually taken.

While it is possible that the database was accessed by malicious actors, it’s also not uncommon for security researchers to come across unprotected databases and access them for analysis, particularly if they appear to belong to a major organization.

In a letter sent out to affected individuals, Virgin Media said the database was accessible since at least April 19, 2019, and the unauthorized access occured recently.

Virgin Media claimed it quickly shut down access to the database once it learned of the exposure. The company launched an investigation into the data breach and notified the Information Commissioner’s Office.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Accenture Acquires UK-Based Context Information Security for $140 Million

Facebook Sues Namecheap Over Fraudulent Domains

Zoho Working on Patch for Zero-Day Vulnerability in ManageEngine Product

Virgin Media Exposed Personal Information of 900,000 People

Nearly 1 Million Domains Use DMARC, but Only 13% Prevent Email Spoofing

2019 CISO Forum, Presented by Intel (Ritz-Carlton, Half Moon Bay CA)

2020 ICS Cyber Security Conference | USA [Oct. 19-22]

2020 ICS Cyber Security Conference | Singapore [April 2020]