IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Foxtons customer data leaked onto the dark web

The company has been accused of "failing" to inform customers after becoming aware of data leak last month

Financial details belonging to customers of UK estate agency Foxtons are widely available on the dark web following a malware attack in October last year that affected parent company Foxtons Group.

Despite admitting that the incident affected its subsidiary Alexander Hall, which specialises in mortgage broking, Foxtons assured its customers at the time that no “sensitive data” had been stolen.

However, it has now been revealed that anyone with access to the dark web can view 16,000 card details, addresses and private correspondence - such as details of paid fees - belonging to Foxtons Group customers prior to 2010.

The personal information has been available since at least 12 October 2020, inews reports, two days after the malware attack took place. Since then, the files have been viewed over 15,000 times.

The company is accused of having knowledge of the availability of the data since last month and of failing to inform its customers, particularly those affected by the breach.

According to its website, the estate agency holds “over three million customer records”.

Ray Walsh, digital privacy expert at ProPrivacy, told IT Pro that it’s unsurprising that “sensitive consumer data stolen from Foxtons Group last October is floating around the dark web”.

Related Resource

Cost of a data breach report 2020

Find out what factors help mitigate breach costs

cost of a data breach report 2020 - whitepaper from IBMDownload now

“This is, after all, the point of these types of hacks,” he added. 

Walsh noted that around 20% of the analysed cards details stolen in the attack are still active, “meaning that those consumers need to be informed now so that they can cancel their cards, and check back through their statements for any irregularity”.  

“If Foxtons knew the full scale of this breach two days after the attack – and did nothing to warn consumers – it would be an astonishing dereliction of duty, but we must now wait for the ICO investigation to assess what happened and what kind of fines Foxton should face,” he said.

Foxtons reportedly informed the Information Commissioner’s Office (ICO) of the attack last year, but Walsh believes that “it is likely a fine will be imminent”. 

“Some of the data that has been unearthed on the dark web predates 2010, and the hacker has suggested that the older information is being used to advertise the hack while selling more up-to-date records in secret. If this is true the risk to consumers is even bigger and it is vital that Foxtons immediately contact all customers potentially caught up in this mess,” he added.

However, a Foxtons spokesperson told IT Pro that the company had "forensically been through all the stolen data and confirm it is both old and incomplete therefore not useable by a third party and not possible for it to cause financial loss or harm to those affected customers".

"All necessary disclosures have been made and full details of the attack were provided to the FCA and ICO at the time. We are satisfied that the attack did not result in the loss of any data that could be damaging to customers and believe that the FCA and ICO are satisfied with our response," they added.

Featured Resources

Activation playbook: Deliver data that powers impactful, game-changing campaigns

Bringing together data and technology to drive better business outcomes

Free Download

In unpredictable times, a data strategy is key

Data processes are crucial to guide decisions and drive business growth

Free Download

Achieving resiliency with Everything-as-a-Service (XAAS)

Transforming the enterprise IT landscape

Free Download

What is contextual analytics?

Creating more customer value in HR software applications

Free Download

Recommended

Mastering endpoint security implementation
Security

Mastering endpoint security implementation

18 May 2022
The Total Economic Impact™ of Apple Mac in Enterprise: M1 update
Whitepaper

The Total Economic Impact™ of Apple Mac in Enterprise: M1 update

12 May 2022
Dell Technologies World 2022: Dell unveils fastest storage architecture in company history
Server & storage

Dell Technologies World 2022: Dell unveils fastest storage architecture in company history

4 May 2022
Dell Technologies World 2022: Dell unveils security offerings for major cloud providers
public cloud

Dell Technologies World 2022: Dell unveils security offerings for major cloud providers

3 May 2022

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

13 May 2022
Preparing for the 3G sunset
Network & Internet

Preparing for the 3G sunset

18 May 2022
(ISC)2 launches free scheme to get 100,000 UK citizens into cyber security
Careers & training

(ISC)2 launches free scheme to get 100,000 UK citizens into cyber security

17 May 2022