Data breach at BBC, personal information of 25,000 employees disclosed

A security incident occurred at the British Broadcasting Corporation (BBC) on May 21. An unknown party gained unauthorized access to personal information of thousands of current and past employees.

The files, which were hosted in the cloud, include some pension scheme members’ private information, including details such as full names, national insurance numbers, dates of birth and home addresses. The British public service broadcaster indicates that no telephone numbers, email addresses, bank details, financial information, usernames or passwords have been exposed.

A spokesperson for the pension scheme tells The Guardian that 25,290 current and former employees have been affected by the incident. The data files involved were copies and there are no signs that ransomware or other malicious software was involved. Therefore, there is no impact on the day-to-day operations.

A first analysis shows there’s no evidence that any obtained information has been misused. Cybersecurity specialists will continue to monitor this.

Additional security measures in place

“We sincerely apologise to all members affected,” BBC says in a security update. The broadcaster promises to take the matter ‘extremely seriously’ and reassures (former) employees that the source of the incident has been secured.

“We are working at pace with specialist teams internally and externally to understand how this happened and have also put in place additional security measures to monitor the situation.”

BBC encourages members to be cautious of any unsolicited and unexpected communications that ask for personal information, or wants members to take unnecessary steps. “This includes unexpected letters, telephone calls, texts or emails and information that refers you to a web page. Please also avoid responding to, clicking on links, or downloading attachments from suspicious email addresses. If you are unsure don’t respond,” the broadcast corporation advises.

Victims involved will receive 24 months of free access to credit and web monitoring service. The incident has been reported to the UK's privacy regulator, the Information Commissioner’s Office (ICO).