RESOLVED 118 118 Money - Personal Details Accessed by Cyber Criminals

randrews1

Hello All,

Trying to get some advice and see if anyone else is in the same boat. 

I currently have a loan with 118 118 Money and received an email from them on 28/03/2020 advising that on 20/03/2020 there was illegal, unauthorised access to their network and recordings of customer service calls were accessed. Sensitive, personal information would have been shared on these phone calls, although 118 118 Money are not too concerned: “We believe that, since the data is held in the form of call recordings, it would be extremely time consuming for anyone to attempt systematically to extract or copy your personal information.”

I have called 118 118 Money Customer Service a few times and since March, have had numerous phone calls and emails attempting phishing and I was wondering what I can do? I have reported it to the ICO and complained to 118 118 Money, but they are just offering complimentary Experian Identity Plus Membership.

Hopefully someone can advise me what to do next and who to contact for further assistance. Would this be a matter for the Financial Ombudsman and would affected customers be entitled to any compensation?

Thank you in advance. 

[Deleted User]

You don't need to do anything else, but keep an eye on your credit files, not just Experian.

jonnygee2

Make sure that your passwords, PINs etc are not related to any personal information that could have been given over the call. They should not be anyway, but double check.

Be extra vigilant about people calling you, you are obviously doing this already which is good. If someone does use this data maliciously, my guess would be that they would use the knowledge of your data to gain your trust, or something along those lines. 

jonesMUFCforever

Were they breached only on 20th March or was it ongoing?
If it was one day - did you contact them then - if not what are you worrying about?

randrews1

jonesMUFCforever said:

Were they breached only on 20th March or was it ongoing?
If it was one day - did you contact them then - if not what are you worrying about?

I am only aware of a breach taking place on 20th March and unsure how long the attack lasted in duration. 

I contacted their complaints department as soon as I received their communication on 28th March however I have not had a response as yet (I am aware it can take 8 weeks).

I am worried that my personal information was maliciously accessed and since the attack, fraudsters have attempted to carry out phishing on me which never happened prior to March. It may be a coincidence, but I believe it is linked. 

jonesMUFCforever

Well good luck with proving that. There are always fraudsters trying to get information and cash from you - personally I think you are over thinking this.
So did you contact them on the date - as it seems only phone calls were compromised.

randrews1

jonesMUFCforever said:

Well good luck with proving that. There are always fraudsters trying to get information and cash from you - personally I think you are over thinking this.
So did you contact them on the date - as it seems only phone calls were compromised.

I’m not trying to prove anything. I don’t believe I am overthinking it; Would you not consider it odd that I have never had phishing attempted prior to the data breach, but I have post-breach? I am not comfortable with someone, particularly fraudsters or hackers having my personal, sensitive information especially due to a data beach. 

I think you have misunderstood. The breach occurred on 20/03/2020 but they accessed all historical call recordings. I did not call 118 118 Money on 20/03/2020, but had done previously. 

jonesMUFCforever

No - there has been more phishing attempts in last 8 weeks because all over the world people have been stuck at home tapping away at their devices - so when you called them what information would you have revealed ?

randrews1

jonesMUFCforever said:

No - there has been more phishing attempts in last 8 weeks because all over the world people have been stuck at home tapping away at their devices - so when you called them what information would you have revealed ?

Ok, I did not realise you had access to data or evidence which detailed the number of worldwide phishing attempts. 

I revealed personal, sensitive information that I am certainly not going to publish or discuss on the internet. 

This thread was established so I could gain advice on what actions I should take to further protect myself and what can be done so I can pursue my complaint with 118 118 Money to ensure there are no repeats of this data breach for their customers. If you have nothing constructive to provide, I would kindly request that you stop replying as you have not proved to be very helpful. 

fwor

randrews1 said:

This thread was established so I could gain advice on what actions I should take to further protect myself and what can be done so I can pursue my complaint with 118 118 Money to ensure there are no repeats of this data breach for their customers. If you have nothing constructive to provide, I would kindly request that you stop replying as you have not proved to be very helpful. 

There's pretty much nothing you can do to "further protect yourself". The information has gone - it's out there and nobody can do anything to reverse that. If you know of things that you referred to in your telephone conversations that can be changed - such as passwords - then you should change them. But other personal data is not likely to be changeable, so you just have to accept the fact that it is in the hands of unknown persons.

You cannot "ensure that there are no repeats of this data breach". Generally these types of attack rely on computer weaknesses that few people know about until after the event. While there continue to be computer weaknesses, these attacks will continue, no matter what you do.

Of course, if you want compo from 118 118, that's a different matter, but it won't have a material effect on either of the above.

randrews1

Many thanks for all useful comments. I now consider this matter to be taken as far as it can and this thread can be closed.