Law Firm Claims Virgin Media Data Breach Victims Due £5k Each

Cable TV and broadband ISP Virgin Media UK appears to be facing the prospect of a “group litigation” (class action) lawsuit from Your Laywers, which claims that the operator’s failure to protect the personal details belonging to 900,000 of their customers could result in each being able to claim £5,000 (c.£4.5bn total).

At the start of last month Virgin Media revealed that the personal details belonging to 900,000 of their customers had been exposed by an “incorrectly configured” marketing database (here), which had apparently been “accessed on at least one occasion” but they didn’t know by whom or if any information had actually been used (the database is understood to have been accessible since 19th April 2019).

Initially the operator announced that the database itself had contained the names, home addresses, email and phone numbers of both customers and potential customers alike, but NOT passwords or financial details. But it later transpired, via internet security firm TurgenSec, that the database also contained a lot of other data for some customers (e.g. IP addresses, requests to block or unblock various pornographic sites etc.).

All of this information was in plaintext and unencrypted, which effectively meant that anyone browsing the internet could clearly view and potentially download all of it without needing any specialised equipment, tools, or hacking techniques. “Anyone with a web-browser could access it,” claimed TurgenSec after discovering the database. Virgin promptly closed the database and notified affected customers soon after becoming aware.

Queue the Lawyers

At present the Information Commissioner’s Office (ICO) is already known to be conducting an investigation, but in an unusual twist we’ve now learnt that law firm Your Laywers is collecting interest from those affected by the breach and appears set to launch a group action against Virgin Media.

“If you’ve been notified by Virgin Media that your data was exposed during the breach incident, then you could be entitled to claim thousands of pounds in compensation,” says the firm (up to £5,000 per customer is one suggested figure). As you might expect this is one of those “no win, no fee” style firms, which will of course have a vested interest in making such things look as financially attractive as possible.

Over the past couple of years a new wave of group litigation under UK data protection legislation has cropped up (we’ve seen cases started against data breaches at British Airways, Morrisons etc.), which have potentially placed additional liabilities upon businesses; as if the possibly huge fines under GDPR weren’t worry enough.

According to the ICO, damages for breach of data protection legislation may be “material” (e.g. financial losses) or “non-material” (e.g. distress) and indeed previous cases have shown that damages may be awarded for a “loss of control” over personal data, even in the absence of pecuniary loss or distress.

In this case it appears as if Your Laywers intend to claim compensation for both financial and emotional distress, although it’s unclear how they’ve arrived at the £5,000 figure suggested in one article. Normally you’d have to prove this (e.g. a start would be to show that somebody had actually abused the data) but, as above, damages could conceivably still be awarded for just a “loss of control” over the data itself.

Aman Johal, Director at Your Lawyers, said:

“Your Lawyers has formally notified Virgin Media that we are taking action and our claimant base is growing daily. We urge anyone affected by the breach to make a claim as soon as possible.

Virgin Media failed to take the steps required to keep customer data safe and it is vital for the company to understand the severity of this breach.

There’s simply no excuse. This was an avoidable event, and we must hold Virgin Media to account.”

One key challenge here is that the case law around claims for the loss of control of data is still evolving and we have yet to see how any court will give effect to that in practice. Meanwhile the idea that Virgin Media could end up paying out billions of pounds does seem a touch unrealistic as few businesses could realistically survive such an outcome, especially when no financial details were exposed.

As for that Morrisons case, the claim for compensation against them recently hit a problem after a ruling found that the company is not vicariously liable for the acts of the employee. Each case is different and a court will probably still need to see some demonstration of harm. If any money were to be awarded, such as for loss of control over the data, then we suspect it would be for a far more modest figure than £5k.

Telecoms Lawyer, Neil Brown of decoded.legal, told ISPreview.co.uk:

“Unless there is some particularly unusual circumstance, it seems unlikely to me that a court would give £5,000 to someone simply because they were involved in a breach, without some actual demonstration of some kind of harm. While a court might make an award for loss of control of personal data, I’d have thought it would be far more modest.”

Naturally Virgin Media has not commented, as is standard practice where lawsuits are concerned.