WARNING: Logged in to https://www.postcodelottery.co.uk and discovered a big data breach!

angryoldgit

Please be aware if you use Postcode Lottery. Its had a serious problem this morning. I logged in only to find I was logged into someone else's account where I could read all their personal data. Refreshed the page and another persons details were laid bare.

flaneurs_lobster

Have you told Postcode Lottery?

Vitor

That's why it's called a lottery 

flaneurs_lobster

Vitor said:

That's why it's called a lottery 

Might sign up.

If the bit that pays out money is as generous (and flaky) as the bit that gives away other user's details then its got to be worth a punt.

SURREYDAVE

Same here — I experienced the exact same issue. I called them to report it, but they said they were already aware of the problem. I sent e mail first but looks to be a 5 day window to reply.                                                                                    I could also see another member’s profile details, which is really worrying. I wonder who may have seen my details?                                                                                                                                                                                  It sounds like it maybe a data protection (GDPR) issue, and I also think they should be contacting all users today- to explain what happened and advise us to change our passwords — which I’ve already done just in case.                  Their site is currently locked for log in 

victor2

Another hacked system perhaps?

Either that or somebody really screwed up an "update" to their system. If what's said above is true, it surely must be reported to the ICO.

Ergates

victor2 said:

Another hacked system perhaps?

Either that or somebody really screwed up an "update" to their system. If what's said above is true, it surely must be reported to the ICO.

More likely to be an internal screwup than a hack.

Definitely a GDPR breach and definitely needs reporting to the ICO - I expect that's already happened.

What's interesting/disturbing is that they apparently didn't take the site off line as soon as they initially learned it was happening!

DSW45

Like everyone else I logged in this morning and was presented with someone elses account containing all their data. I have written to Postcode lottery to advise that there is a major Data protection issue and have asked them what they are doing to resolve and what actions will need to be taken by individuals to change personal details which have been exposed to third parties. postcode lottery should have reported the breach as per the data protection Act

• Report the breach:
  • If the breach poses a high risk to individuals' rights and freedoms, notify the relevant supervisory authority, such as the ICO, without undue delay, and at the latest within 72 hours of becoming aware of it. 
• If the risk is high, you must also notify the affected individuals.

MouldyOldDough

The site is still up and running with no reports or warnings !

marcia_

It's showing an application error when i try and log on so they are working on it 

brewerdave

Probably an official hack on behalf of Rachel from Accounts - she is going to tax all those individuals who have enuf money to gamble on ......the Postcode Lottery !!!