Data breach at Virgin prompts encryption order

Virgin Media has been ordered to encrypt all portable media that is used to move data after it lost the details of 3,000 would-be customers.

According to the Information Commissioner's Office, the individuals' data went missing after an unencrypted CD was lost by Virgin Media.

Full Disclosure campaign

silicon.com is aiming to make businesses and government take data security more seriously. Read more here.

The CD was given to the telco by Virgin Media reseller Carphone Warehouse and contained data on individuals who had expressed interest in signing up to Virgin Media services, including names and addresses and in some cases bank details.

The loss, which occurred in May, constitutes a breach of the Data Protection Act, according to the ICO.

The watchdog has now ordered Virgin Media to ensure all portable media that it uses to move data is encrypted. Any company Virgin Media uses for data processing also has to use encryption software.

A spokesman for Virgin Media said the telco had a policy in place to use encryption before the breach and the lost data had occurred as a result of "human error", with one staff member burning information to a CD outside the company's guidelines.

"When we found out we contacted everyone on the list and offered them credit protection to ensure they weren't at risk," he said, adding that staff training on data handling has also been stepped up.

The breach comes after a number of high-profile government data breaches, with more than 29 million records lost by public sector in the last 12 months.