Staysure hack leaves customers’ finances vulnerable

Insurance company blasted over unencrypted credit card details and customer notification procedures.

Data theft

Travel insurance provider to the over-50s Staysure has admitted customers may have had their financial information stolen during an October 2013 cyber attack.

The company has warned the encrypted payment card details of 93,000 customers who purchased insurance before May 2012 may have been stolen, along with unencrypted CVV details (the three digit security code on the back of cards). Customer names and addresses may also have been taken, it admitted.

A spokesperson for the company told IT Pro: "As soon as we became aware of the problem on November 14, we immediately removed the software and systems that the attackers exploited, and we are confident that we have taken the right steps to protect our customers in the future.

"We informed the relevant card issuing bodies straight away and subsequently The Financial Conduct Authority (FCA), the Information Commissioner's Office (ICO) and the police."

Independent consultants had also been brought in to work out what went wrong and how far-reaching the hack was, the spokesperson added.

Staysure's CEO has also issued a statement via the organisation's website, saying the firm is "deeply sorry and [is] working diligently to make sure that inconvenience to customers is minimised."

He also sought to reassure other customers, stating that if they have not been written to, they have not been affected.

However, the company's handling of the situation has been criticised on two fronts. Firstly, it took a month for the affected customers to be notified and the stored CVV information should never have been retained.

One customer told the BBC she was "astonished they kept [the CVV code] in an unencrypted form".

"I can't understand why I wasn't informed earlier. [Staysure] had clearly been in contact with the Financial Conduct Authority, the Information Commissioner and the police and it seems to me as a victim I was the last person to find out about it," the customer explained.

Staysure's spokesperson said, based on the advice it received, the company waited until it had identified the affected customers to prevent the spread of unnecessary worry. He added the company no longer retains any of its customers' financial information.

An ICO spokesperson confirmed it was investigating the hack.

"We have recently been made aware of a possible data breach which may involve Staysure. We will be making enquiries into the circumstances of the alleged breach of the Data Protection Act before deciding what action, if any, needs to be taken," the spokesperson said.

Featured Resources

Four cyber security essentials that your board of directors wants to know

The insights to help you deliver what they need

Download now

Data: A resource much too valuable to leave unprotected

Protect your data to protect your company

Download now

Improving cyber security for remote working

13 recommendations for security from any location

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

Recommended

Phishing attacks surge ahead of Black Friday and Cyber Monday
Security

Phishing attacks surge ahead of Black Friday and Cyber Monday

17 Nov 2020
How to protect against a DDoS attack
Security

How to protect against a DDoS attack

17 Nov 2020
Hackers steal 8.3 million user records from 123RF
Security

Hackers steal 8.3 million user records from 123RF

13 Nov 2020
Wisconsin Republican Party allegedly loses $2.3 million to hackers
hacking

Wisconsin Republican Party allegedly loses $2.3 million to hackers

30 Oct 2020

Most Popular

macOS Big Sur is bricking some older MacBooks
operating systems

macOS Big Sur is bricking some older MacBooks

16 Nov 2020
46 million Animal Jam accounts leaked after comms software breach
Security

46 million Animal Jam accounts leaked after comms software breach

13 Nov 2020
How computing has revolutionised Formula 1
Sponsored

How computing has revolutionised Formula 1

11 Nov 2020