CARPHONE Warehouse has been fined £400,000 after a security failure allowed unauthorised access to the personal data of millions of customers.
One of the retail giant's computer systems was affected in the 2015 cyber attack when intruders gained access via out-of-date WordPress software using valid login credentials.
The Information Commissioner's Office (ICO) said the fine was one of the largest it had issued in response to the company's failure to secure the system.
A detailed investigation found "multiple inadequacies" in Carphone Warehouse's approach to data security and concluded the company had failed to take adequate steps to protect the personal information.
The criminals were able to access the personal data of more than three million customers and 1,000 employees in the attack, but the ICO said to date there had been no evidence that it had resulted in identity theft or fraud.
The data included names, addresses, phone numbers, dates of birth, marital status and, for more than 18,000 customers, historical payment card details.
