Paddy Power condemned after waiting FOUR YEARS to tell 650,000 customers of data breach

Bad gamble?

Popular gambling site Paddy Power has been heavily criticised after taking an incredible four years to tell 650,000 customers that their personal data has been compromised in a data breach dating back to 2010.

In a website announcement posted on Thursday in advance of customer notification letters, the company sought to play down the incident that only came to light by chance in May 2014 after it took legal action to recover data from an unnamed individual living in Canada after a tip-off.

Once examined, this data turned out to include customer names, web user names, email and home addresses, phone numbers, dates of birth as well as the answers to security questions for 649,055 who joined the service up to 2010.

Account passwords were not compromised and anyone who joined since the time of the breach would not be affected, the company said.

"We take our responsibilities regarding customer data extremely seriously and have conducted an extensive investigation into the breach and the recovered data," claimed the firm's online managing director, Peter O'Donovan.

"That investigation shows that there is no evidence that any customer accounts have been adversely impacted by this breach," he added.

The firm said it had detected what it described as an "attempted" breach of its systems in 2010 but after investigation decided that no financial information or passwords had been lost.

Despite the PR spin, the company's conduct begs some hard questions.

If it detected a data breach in 2010, why did it not inform the authorities or customers at the time? According to the company's account, the Irish Data Protection Commissioner was only told in May 2014, years after the incident.

It will also sound complacent that the firm has sought to dismiss the breach simply because 'only' personal data was lost; customers might point out that while credit card numbers can be changed, names and dates of birth can't. Financial losses resulting from any breach would have been its responsibility.

"It's shocking to see that Paddy Power has waited over four years to inform its users of the cyber-attack on the company, joining the ranks of eBay and Orange France that also waited far too long between a breach and public disclosure," commented George Anderson of security firm Webroot, hitting the nail square on its head.

"Waiting four years isn't just irresponsible, it's senseless," he said.

Clearswift SVP of engineering Maksym Schipka was equally scathing about the firm's behaviour.

"A breach on this scale, combined with the lack of transparency demonstrated by the company will certainly affect its professional reputation," he said. "It implies a huge failure on Paddy Power's behalf to maintain control and protection of its users' critical information."

The company's incident response is reminiscent of eBay, which in May admitted it had suffered a major data breach of up to 230 million users dating back to February that only came to light after a leak.

Join the CSO newsletter!

Error: Please check your email address.

Tags Personal TechPaddy Powersecuritydata breach

More about eBayOrangeWebroot

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by John E Dunn

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place