Ladbrokes secures personal data, wanna bet?

David Heath
Monday, 25 January 2010 09:00

Business IT - Security

Reports emerged over the weekend of a data breach involving the personal and gambling details of 4.5M Ladbrokes customers.  Ladbrokes are adamant that customers are safe.

Yesterday, The Mail on Sunday newspaper published a summary of an exchange with 'Daniel' of Melbourne (in Australia) where information regarding the exposure of the personal details of 4.5M customers was displayed for all to see.

Prior to going public, the newspaper passed full information to Britain's data oversight group, the Information Commissioner's Office (ICO) for a more formal investigation.

'Daniel' claimed to be from DSS Enterprises, an interesting organisation [note: iTWire makes no affirmation as to the veracity of the other information on that page other than to observe the listing of company and business names], whose principal is Dinitha Subasinghe according to a variety of company searches.  The newspaper did not offer an opinion as to whether 'Daniel' spoke with any kind of accent.

Initially, 'Daniel' told the newspaper that he was going to contact Ladbrokes with regard the security breach but decided to contact the media directly with the information that he'd been passed the stolen data by a relatively junior employee of Ladbrokes who was trying to sell it on.

Although agreeing that he'd done work for Ladbrokes in 2007 and 2008, Subasinghe insisted he'd never had access to the databases but noted that he'd remained in touch with a couple of employees socially.

Ladbrokes countered by insisting "This is a criminal act and we are working with the police, the ICO and the newspaper to identify and apprehend the culprit.

“We are in the process of contacting customers to apologise for this breach in security and to reassure them that everything is being done to protect their personal information.

“Importantly, we do not believe that customer accounts or banking data can be accessed."

It's the last statement that causes concern as no part of the information provided about the breach suggests it was anything less than a full database access.

We await further action from Britain's ICO and the Australian Federal Police in this matter.