Bupa fined £175,000 due to worker attempting to sell customer data on the dark web

The rogue employee attempted to sell customers' names, date of birth and email addresses

Bupa logo

Bupa has been fined 175,000 by the ICO after one of its employees tried to sell the records of 547,000 Bupa Global customers on the dark web early last year.

The employee in question managed to lift the data from Bupa's CRM system, which holds data relating to 1.5 million of the company's customers in total. The information stolen included dates of birth, email addresses and nationality.

The ICO said Bupa failed to protect its customers' data by not monitoring its CRM system, SWAN, was used, allowing the employee to steal the information and then send the records to his personal email account. This data was then sent by the employee to the dark web between January and March last year.

Bupa was only made aware of the issue on 16 June 2017 when a partner told the company it had found the customer information for sale. The company also received 198 complaints about the incident and at this point, the employee in question was dismissed and Sussex Police informed.

After investigating into the breach, Bupa realised there was a flaw in its activity monitoring system that meant it wasn't alerted to unusual activity in the system, such as bulk data downloads. The ICO said this was a breach of the Data Protection Act 1998.

"Bupa failed to recognise that people's personal data was at risk and failed to take reasonable steps to secure it," ICO director of investigations Steve Eckersley said.

"Our investigation found material inadequacies in the way Bupa safeguarded personal data. The inadequacies were systemic and appear to have gone unchecked for a long time. On top of that, the ICO's investigation found no satisfactory explanation for them."

The ICO said it has fined Bupa under the Data Protection Act 1998 and not the more recent General Data Protection Regulation and 2018 Act because the incident occurred before the new legislation came into force.

Featured Resources

BIOS security: The next frontier for endpoint protection

Today’s threats upend traditional security measures

Download now

The role of modern storage in a multi-cloud future

Research exploring the impact of modern storage in defining cloud success

Download now

Enterprise data protection: A four-step plan

An interactive buyers’ guide and checklist

Download now

The total economic impact of Adobe Sign

Cost savings and business benefits enabled by Adobe Sign

Download now

Recommended

ICO to relax GDPR enforcement during coronavirus economic downturn
General Data Protection Regulation (GDPR)

ICO to relax GDPR enforcement during coronavirus economic downturn

16 Apr 2020
The NHS teams up with Apple and Google on coronavirus tracking app
privacy

The NHS teams up with Apple and Google on coronavirus tracking app

14 Apr 2020
Health sites are 'unlawfully' sharing medical data with Facebook and Google
data protection

Health sites are 'unlawfully' sharing medical data with Facebook and Google

7 Apr 2020
Supreme Court rules Morrisons was not liable for 2014 data breach
data protection

Supreme Court rules Morrisons was not liable for 2014 data breach

1 Apr 2020

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
Google removes 17 apps infected with evasive ‘Joker’ malware
malware

Google removes 17 apps infected with evasive ‘Joker’ malware

28 Sep 2020