Personal Details Accessed

[Bigsis]

My daughter has been informed by a previous work colleague that the company, which she left a few months ago, was robbed and the employees' personal information was stolen. She is worried her address, NI number & bank details may have been accessed.

This apparently happened 2 months ago & someone has read an email between the director & HR saying not to tell anyone!

Does she need to inform her bank, as she is concerned about protecting her credit score & identity, She has just got a new mortgage & doesn't want any problems with that going through.

Your advise would be appreciated, thank you.

[Sangie595]

Re: Personal Details Accessed

My daughter has been informed by a previous work colleague that the company, which she left a few months ago, was robbed and the employees' personal information was stolen. She is worried her address, NI number & bank details may have been accessed.

This apparently happened 2 months ago & someone has read an email between the director & HR saying not to tell anyone!

Does she need to inform her bank, as she is concerned about protecting her credit score & identity, She has just got a new mortgage & doesn't want any problems with that going through.

Your advise would be appreciated, thank you.

To be honest I am really not 100% certain! My instinct would be to say that telling the bank can't do any harm, although, in my experience (identity theft did once happen to me) it is not the bank that is vulnerable in such instances. But I suggest that asking the bank for advice might be a good place to start!

In her shoes I might be tempted to write to the company saying that she knows that employees personal information has been stolen, and ask in what form that data existed and what the thieves actually have. She doesn't have to say how she found out, but if they are inclined to lie about it, in her shoes, I might casually suggest that if I don't get a good answer the Information Commissioners Office and the local paper will be my first ports of call. If data was only stored on computers that were stolen, whilst the information may still be accessible, it is likely that the thieves were more interested in the value of the computers and the information is simply collateral damage. If it were paper records, that suggests more targeting of the information since thieves don't usually break in to steal paperwork!

[Bigsis]

Re: Personal Details Accessed

Thank you very much, I'll pass that info onto her.

[Amethyst]

Re: Personal Details Accessed

I believe the company has a duty to inform the people whos data was stolen of the fact so they can take preventative action if necessary, principle 7.

https://ico.org.uk/for-organisations...le-7-security/

What should I do if there is a security breach?

If, despite the security measures you take to protect the personal data you hold, a breach of security occurs, it is important that you deal with the security breach effectively. The breach may arise from a theft, a deliberate attack on your systems, from the unauthorised use of personal data by a member of staff, or from accidental loss or equipment failure. However the breach occurs, you must respond to and manage the incident appropriately. Having a policy on dealing with information security breaches is another example of an organisational security measure you may have to take to comply with the seventh data protection principle.
There are four important elements to any breach-management plan:
1. Containment and recovery – the response to the incident should include a recovery plan and, where necessary, procedures for damage limitation.
2. Assessing the risks – you should assess any risks associated with the breach, as these are likely to affect what you do once the breach has been contained. In particular, you should assess the potential adverse consequences for individuals; how serious or substantial these are; and how likely they are to happen.
3. Notification of breaches – informing people about an information security breach can be an important part of managing the incident, but it is not an end in itself. You should be clear about who needs to be notified and why. You should, for example, consider notifying the individuals concerned; the ICO; other regulatory bodies; other third parties such as the police and the banks; or the media.
4. Evaluation and response – it is important that you investigate the causes of the breach and also evaluate the effectiveness of your response to it. If necessary, you should then update your policies and procedures accordingly.
These issues are considered in greater detail in our guidance on data security breach management (pdf). We have also produced Notification of data security breaches to the ICO (pdf) and Notification of PECR security breaches (pdf). These provide guidance on:

• the circumstances in which we expect organisations to notify us of security breaches;
• the information we need in those circumstances; and
• what organisations can expect us to do after they notify us.

Use our security breach notification form (Word) to report a breach to us.