Virgin Media left a marketing database open for 10 months — 900,000 exposed

Virgin Media, one of the UK's largest cable and telecoms providers, kept a marketing database that was incorrectly configured so that it could be accessed without authorisation. The misconfiguration was not caught for about ten months. In March 2020 the company disclosed that roughly 900,000 people had been affected, including fixed-line customers representing about 15% of that customer base.

The exposed data was contact information: names, home and email addresses and phone numbers. Virgin Media said the database held no passwords and no financial details such as credit card or bank account numbers. The company said it became aware of the issue, shut down access to the database, and kept the Information Commissioner's Office updated.

The case is small next to the mega-breaches, but its mechanism is the common one: the database was not hacked so much as left open. A configuration mistake sat unmonitored for the better part of a year, and the gap between 'set up' and 'checked' became the exposure of nearly a million customers' personal details.