BreachExchange mailing list archives
Identity theft after Watford Community Housing data leak
From: Destry Winant <destry () riskbasedsecurity com>
Date: Wed, 26 Aug 2020 09:44:46 -0500
https://www.watfordobserver.co.uk/news/18677092.leak-watford-community-housing-vulnerable-tenants-risk/ Some victims of a data breach which leaked thousands of tenants’ personal details have become victims of fraud, been under threat of physical harm, and some were forced to relocate. The blunder was made by Watford Community Housing when it sent out an email on March 23 to all tenants to inform them of changes to services during the coronavirus outbreak. But attached to the email was a spreadsheet that contained personal information of the housing association's 3,545 tenants. The information included full names, gender, addresses, mobile numbers, email addresses, ethnic origins, religion, and sexual orientation. One tenant, Sasha, previously told the Observer that the leaked information put many vulnerable tenants in “life changing and life-threatening situations”. Now Aman Johal, a lawyer and director of Your Lawyers which is representing nearly 200 clients affected, has confirmed that many vulnerable people were put into psychological, physical, and financial threat from the data being in the public domain. Mr Johal said: “I think there’s a lack of understanding about how serious and significant these breaches can be on individuals. “Many of these individuals are vulnerable, some of the clients for example have been victims of domestic violence – and this data breach now puts them at further risk essentially in terms of violence.” The lawyer exemplified one client who had their identity stolen during the breach, which included a bank account and credit card being taken out in her name and her email account compromised by fraudsters. The incident is being investigated by Action Fraud. But Watford Community Housing say the risk of identity or financial fraud is low. Other clients have had to be rehomed with the assistance of UK authorities due to the leak causing a “real risk”. Under the General Data Protection Regulation (GDPR), it is specified there should be “appropriate technical or organisational measures” ensuring the “appropriate security of personal data”. Personal information of more than 3,500 tenants leaked by housing association Tenants could claim up to £15k after personal information of thousands leaked Mr Johal said: “In terms of families having to move location and change jobs, that’s going to have significant impact on their mental health as well as financially. “Some commenters said you need to prove consequential loss for compensation – that’s just incorrect, that’s not right in the law. People affected by a data breach are entitled to claims for injuries to feelings, we call it distress. “And when talking about the lower levels impacted by the breach, you don’t have to show the psychiatric injuries or financial loss. “Watford Community Housing have a real obligation to take care of that personal data, particularly when they have vulnerable individuals that they hold data for – they’ve not learnt from highly publicised data breaches which have occurred.” Mr Johal constantly made parallels to similar major data breaches which the firm helped its victims – including the personal details leaked of 400,000 British Airways customers in 2018, and the 56 Dean Street breach which leaked nearly 800 patients who attended HIV clinics. The Dean Street breach was claimed to be a result of “human error”, a term previously used by Tina Barnard, the chief executive of Watford Community Housing. Around 39 per cent of the Dean Street claims were settled to an average of £10,562.50 – which was settled against the advice of the firm. Your Lawyers expect to recover around £21,000 for most of the other Dean Street claimants, as the cases are still ongoing. Mr Johal believes a similar amount could also be claimed for many of the Watford Community Housing claimants, but some of the more significantly impacted victims could claim even more. Fletchers Data Claims, another firm representing clients affected, said most victims could claim a minimum settlement between £1,000 to £5,000, while others seriously affected by the breach could earn up to £15,000. What did Watford Community Housing say? Watford Community Housing say they are “continually reassessing” their systems and procedures to guard against an error like this happening. The Information Commissioner’s Office (ICO) has carried out a review of the incident. Watford Community Housing say the ICO issued some recommendations to prevent a similar incident happening but does not consider any regulatory action should be taken at this stage. Tina Barnard, the chief executive said: “The security of customer information is extremely important to us. We have clear safeguards in place around the usage and protection of customer data, and this incident was the result of human error. "We have taken a variety of steps to assess the potential impact on those affected, including identifying any safeguarding concerns, and we are providing comprehensive support. “We have written to everyone affected to provide information and guidance. This support package includes access to free credit monitoring services to help give our customers peace of mind." She continued: "However, it is worth noting that the risk of identity or financial fraud is low as no personal passwords, national insurance numbers or financial information, such as bank details or payment history, were affected by the incident. “The ICO has carried out a review of the incident and has issued some recommendations but does not consider that any regulatory action should be taken at this stage. "We take our obligations towards data protection extremely seriously and we are working to implement the ICO’s recommendations.” _______________________________________________ BreachExchange mailing list sponsored by Risk Based Security BreachExchange () lists riskbasedsecurity com If you wish to Edit your membership or Unsubscribe you can do so at the following link: https://lists.riskbasedsecurity.com/listinfo/breachexchange
Current thread:
- Identity theft after Watford Community Housing data leak Destry Winant (Aug 26)