Paddy Power admits mass data mishap

Bookmaker Paddy Power has confessed to a data breach going back to 2010.

Despite the leak affecting 649,055 people, approximately one third of its customers, the company says that no passwords or financial data were leaked.

The breach was uncovered during an  investigation that took place in Canada, after a source revealed that an interceptor in Toronto held customer data from the betting giant. The firm obtained a double court order in order to seize IT assets being held by the man to look over his financial accounts and erase the data.

Close to 650,000 customers were affected by the breach, with 120,000 based in Ireland. No customers who registered with the firm after 2010 have had personal data leaked.

Paddy Power said in a statement:

“The historical dataset contained individual customer’s name, username, address, email address, phone contact number, date of birth and prompted question and answer.

“Customers’ financial information such as credit or debit card details has not been compromised and is not at risk. Account passwords have also not been compromised.”

Paddy Power said that there was no indication from its account monitoring that a breach had taken place, and that it currently is cooperating with the Irish police and the Data Protection Commission to ascertain how the incident occurred.

If an organisation as established as Paddy Power can suffer from a data leak, it is a reminder that SMEs up and down the country need to guard against them as well. Company bosses can browse risk and network forums or they can prioritise I.T. security recruitment and hire someone who can prevent security attacks, saving them a lot of time and money in the process.