| 10 February 2017
The UK's largest sporting retailer, Sports Direct, reportedly suffered a data breach last year but has been accused of failing to tell its workforce that their personal details – including names, email addresses and phone numbers - may have been accessed by a hacker.
Lee Munson, security researcher at Comparitech.com , says: ”Companies are breached all the time and, as unfortunate as that is, it is a likely risk of doing business these days, and one that cannot be avoided with certainty. What is controllable, however, is the way in which the breach is responded to.
“In the case of Sports Direct, the response appears to be woefully inadequate, leaving some 30,000 staff at risk of identity theft and other crimes.
“It’s bad enough that employees’ personal data was stored in an unencrypted form, but the fact that there was no disclosure to them for so long, despite contact being made with the Information Commissioner’s Office, is unforgivable.
“We can only hope that situations like this will be avoided in the future when the new EU GDPR regulations come into play as breaches will then need to be declared within 72 hours or else the company will be liable for massive fines.
“In the meantime, Sports Direct staff may be wondering why their employer fell victim to an attack that appears to have leveraged unpatched systems and a simple failure to store sensitive information in a secure manner.”