Feeds

Demon splurges details of 3,600 customers in billing email

Passwords too

Next gen security for virtualised datacentres

Demon Internet sent thousands of business and government subscribers an email this morning telling them all about a new e-billing system, and tacked on details, including passwords, for 3,600 customers.

The email - supposedly from Simon Blackburn Demon's director of customer service - has been sent to customers opting for e-billing. It includes a guide to the new service along with user names and passwords.

But the email also has a .csv attachment with 3,681 customer records on it. Entries include names, emails, telephone numbers and what looks very like a user name and password.

There are records for New Scotland Yard and other police forces, Alder Hey Children's Hospital and local councils.

The email advises that customers requiring technical help are advised to contact Microgen.

An optimistic Reg reader said: "Someone needs a criminal record (might not be Demon, might be Microgen - see text of email), either way this lapse needs to be chastised in Court."

Given this country's toothless data protection laws, we can be fairly certain that won't happen. But an apology or warning to Demon users to get their passwords changed would be nice.

A spokeswoman for Demon said the company had changed the passwords which were sent out and was in the process of changing user names too. She said there was no evidence of anyone logging-in using someone else's details. The ISP will also be emailing customers whose details have been released.

Demon sent us the following statement:

As a result of human error, customer Information for a limited number of customers who had signed up to Demon’s new paperless billing platform has been circulated as an attachment to an email. To be clear, this information DID NOT contain any financial or payment information (bank details, credits card numbers etc)

On discovery, Demon took immediate steps to secure the information /details and security of customers affected by changing all affected customer usernames and passwords.

We would like to apologise to all concerned but state that this was a limited and isolated case caused by human error and to reassure customers that their security is our key priority and in light of this lapse, we will review all processes and procedures to ensure that it won’t be repeated.

®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.