Yorkshire BS customer data stolen

By LEE BOYCE, EDITOR, THIS IS MONEY
Updated: 07:35 EST, 26 August 2010

An unencrypted laptop containing customers' details was stolen from Yorkshire Building Society in April.

Security breach: A stolen laptop contained customer details

The laptop included a substantial part of Chelsea Building Society's customer database shortly after the two mutuals had merged and was stolen from the group's office in Cheltenham, Gloucestershire.

Yorkshire Building Society said today that they were taking steps to improve data security after the incident.

The Information Commissioner's Office (ICO) has found the building society to be in breach of the Data Protection Act.

After the laptop went missing, private investigators were brought in to assist the police and was then recovered within 48 hours. They confirmed that none of the data had been accessed during the time it was missing – although there had been several attempts to do so.

The laptop had been used by a Chelsea employee who was working from home. The worker returned it to a manager, who then returned it to Chelsea's former head office in Cheltenham.

It was later discovered that the manager had written down the passwords to the computer and left them in a bag with the laptop under a desk overnight.

Yorkshire said the incident happened shortly after it had completed its merger with the Chelsea on April 1, when it was still rolling out its 'more rigorous security procedures' to the society.

The group has agreed to take a number of steps to improve its data security, including that all portable devices, such as laptops, are encrypted - a measure which is already in place at the Yorkshire - and that all staff are aware of the company's policies for the storage and use of personal data.

Staff will also only be given access to the type and amount of personal data necessary for their work.

Mick Gorrill, head of enforcement at the ICO, said: 'It is extremely concerning that an unencrypted laptop containing large amounts of personal data was left unsecured overnight, together with details of its passwords.

'What's more, the fact that the employee did not require all the information to carry out the task in hand created an unnecessary risk which could easily have been avoided.'

But he added that Yorkshire had taken 'prompt and effective action' to prevent a similar incident happening again.

A Yorkshire Building Society spokeswoman said: 'Yorkshire Building Society takes its duty of care to its members very seriously and was in the process of rolling out the Yorkshire's more rigorous security procedures to the Chelsea at the time of the theft.

'The society took immediate and appropriate remedial action and, as the Information Commissioner's Office has acknowledged, there has been a full review of data security with new safeguards put in place to prevent a repeat of this incident.'

Earlier this week Zurich Insurance was fined £2.28m by the Financial Services Authority after losing personal details on 46,000 policyholders.

The data loss occurred in August 2008 when the South African branch of the company lost an unencrypted back-up tape during a routine transfer to a data storage centre, but Zurich UK did not learn about the incident until a year later.

The regulator has previously fined Nationwide £980,000 for data security failings after a laptop containing customer details was stolen from an employee's home.