A member of the Neighbourhood Watch received notification from their pension provider on 28th October that the providers IT network had suffered a cybersecurity attack. It turned out that the attack which was first identified on 16th October resulted in a loss of access to the system, since recovered. However the attack was not solely to the operating systems. Attackers had also accessed data files and hence personal information of pensioners might have been disclosed including: Name, Address, Date of Birth, National Insurance Number, Bank Account Number, Bank Sort Code, Pension Amount & Tax Deductions. In short a comprehensive suite of the members personal data.
Our member was surprised at the delay between the attack and notification, that was sent by post, a letter dated 28th October, received in early December but meanwhile took some limited precautions to secure the data held on their personal computer. Limited, in that the horse had already bolted!
One action of many that the provider had since taken was to arrange for a complementary Experian Identity Plus Membership to be provided to its members. This is a credit and identity monitoring service focussed on identity and resolution of identity theft. Other precautions have also since been taken by our member. Then it was largely a case of wait and see to see what transpired.
And then………..
Whew!!
It has to be said that this is a pretty common scam but the timing, following on the heels of the aforementioned data breach was unfortunate. The email carries only the email address of our member which might suggest that the email address used, valid as it was, came from yet another data breach. Perhaps a more personalised approach has yet to be made! There are a number of things that our member has learnt and some that have since been recommended and these include:
Checking bank statements for unusual payments.
Checking Experian Credit/Identity monitoring report regularly.
Using strong passwords and two factor authentication when possible.
Never give out personal information on the phone.
Get in touch with Action Fraud if you think you are a victim.
Do not respond/reply to scam emails. Including inhibiting return receipts on email clients.
Delete scam emails from your inbox (perhaps take a screencopy before deletion).
At the end of the day, our details are provided to a host of authorities as a matter of course and we have to rely on them to protect our detail and some are better at that than others. It is incumbent upon those authorities to advise those whose data becomes at risk in a timely manner, not some two weeks or so later.
I have to say that I have never felt quite as vulnerable as I have over the last few weeks. Cat is out of the bag. The breach happened to me (Rob), the smutty demand as well.
Just a word however, if you do come across a video of a furtive, flustered chap, wearing a tutu staring into a screen, apparently seeking some form of gratification, it isn’t me.
My furtive, flustered tutu wearing days are long since behind me and as an aged chap, likely if at all, it would be captured on 16mm film.