Personal Data leak - How many? What? and Who?

[#1]

FAO Plusnet staff:

How many accounts were compromised?

Exactly what personal data was exposed?

Are you following GDPR guidelines on the need to inform customers who's data has been exposed?

[#2]

From the lack of response I'll assume the worst. Keep an eye on your bank statements.

[#3]

Thank you for getting in touch

We have contacted the very small handful of people whose accounts were affected. After an extensive investigation there is no evidence to suggest your account is one of them, and we’re very sorry for any concern this has caused.

[#4]

@Ndegwa - Necroposting! Whatever next.

[#5]

---

@Ndegwa wrote:

Thank you for getting in touch

We have contacted the very small handful of people whose accounts were affected. After an extensive investigation there is no evidence to suggest your account is one of them, and we’re very sorry for any concern this has caused.

---

This is all lies. They have not contacted people affected. The data breach is still ongoing. Telephone support to totally useless, they don't care at all and have not taken any action to resolve the data breach. I didn't even get the impression they knew about it.

[#6]

I feel Ive been fobbed off every single time I managed to get through this week.  Ive spent so far 3.5 hours queuing to get through each time and be assured im going to have my services reconnected.  I was cut off even though I paid on the agreed date.  They have still cut off my dialling out facility.  Absolutely shocking customer service, lack of concern, I even heard the girl who took my payment sniggering when I complained about the length of each call was taking to get through.  Four promises of an agent from accounts getting back to me and not one phone call.  All this and even a text message saying ive been overcharged but it wont be deducted untl next month.  Stealing my money and not providing a service!  My patience has diminished, Im contacting Virgin on Monday to change the supplier.  PlusNet, you are disgraceful, and need investigating thoroughly.  Maybe OFCOM needs advising?  As for the breach of data I dread to think whats been going on.

[#7]

---

@gambo123 wrote:

Maybe OFCOM needs advising?  As for the breach of data I dread to think whats been going on.

---

It's the Information Commisioners Office (ICO) that needs to be informed about data breaches within 24h. Plusnet claim to have done this but no one I’ve spoken to on the phone can give me any details. I can only think now that thay have been told to blank customers who report data breaches.

https://www.uswitch.com/broadband/news/2018/09/plusnet_assures_customers_after_minor_data_breach

https://www.theregister.co.uk/2018/09/03/plusnet_faces_customer_amid_ongoing_routine_maintenance/

Plusnet stressed that "full payment details were not visible" – but didn't offer any more specifics about what other users could see, or provide the exact number of affected accounts.

I can confirm that payment details ARE visible.

Plusnet also claim to have fixed the problem. Well if that is the case this must be a NEW data breach.

I think there are probably lots of people in this situation and Plusnet are just overwhelmed and don’t know how to fix the problem.

[#8]

@gambo123 I've just added a ticket for your attention regarding your account: https://www.plus.net/wizard/?p=view_question&id=183109369 

[#9]

Yes, Ive already been told that 2 were raised already, I have now double double checked with my bank and can assure you that a payment of £57.28 has come out of my bank account several  days ago for the payment due, yet im still being told I need to pay.  Ive just sent you my third screenshot this week of the bank reference number and amount showing on my bank statement.  I need this sorting out before Monday.  Thankyou.

[#10]

Hi @gambo123,

I appreciate your comments in regards to this. I can see my colleague has updated your ticket and it is now with our Billing Operations team who are currently working through a backlog of tickets so there may be a slight delay. You can view the ticket here.

[#11]

PASSWORD DATA BREACH:    I experienced a serious data breach which I have investigated and found has almost certainly originated from Plusnet at the precise time I ended my contract with them and when, presumably, my personal data was removed from the 'live' customer database and archived on to a separate one for lapsed/former customers.  Not long afterwards I began to receive blackmail threat emails revealing to me my Plusnet password, which could only have been sourced from their customer data records. I wrote to Plusnet and, naturally, they have denied that any data has been stolen, lost, sold or mishandled. They sent a condescending and patronising reply which does not address the specific issues/questions I raised. A complete whitewash!  I have reported it to the ICO and would urge anyone else who has the same experience to do the same.

[#12]

Hello @Raps1960

I am deeply sorry to hear about the recent experience you had with us and the breach with your security.

I can see we have addressed this issue on this ticket. You can view our response on this matter by Clicking Here

Many thanks.

[#13]

Plusnet did not "address the issue".  i received a patronising and totally inadequate automated reply  - which suggests that you have had a lot of similar password data-breach complaints (or else why would you prepare an automated email response?).

I have reported the matter in full to the ICO, for the personal attention of the Commissioner. 

Some initial research I have conducted online suggests to me that this is the tip of an iceberg and that Plusnet has been leaking customers' personal data, and that the data breach has been illegally concealed and covered up. 

[#14]

Hi @Raps1960 

I'm sorry to hear you feel this way. 

I have looked over the account and con confirm that the ticket which was sent to you was not a Automated reply, but composed by a member of our High Level Escalation team. 

I can see that they investigated the situation with help from our Data Protection Officer and our Cyber Security lead, and came to the conclusion that no personal data was breached as a result of any action taken by Plusnet. 

Did you check the relevant email address you used for your Plusnet account on Have I Been Pwned? as advised? Despite the somewhat comical name of the site, it is a very well known and widely used independent website that allows internet users to check if their personal data has been compromised by data breaches. I myself have used it after a similar situation arose in my personal life and was able to identify where the leak originated from. 

I can also see that the High Level Escalation agent gave an educated guess as to the nature of the issue (which I will not explain on here for obvious reasons) and provided you with an Action Fraud link with information which the Police have drawn up from their research into issues such as this. 

The specific complaint ticket is closed as far as I can see, however, we are able to reopen this and pass it back to the specific HLE  case handler you were dealing should you wish to revisit this with him? 

Kind Regards, 

MoR

[#15]

It read like an 'assembled' (pre-prepared) response to me.  Of course they are going to say that - what else are they going to say?  i was looking for answers to a couple of specific questions - and they were not addressed.  I definitely don't think the password was 'pawn'd'.  I had never previously had any issues with it until I cancelled my Plusnet account. It was only in use with one other website, which I am certain was not the cause of the data leak.  As for my own computer, I have high-quality virus and spyware protection, for which I subscribe.