P&O Ferries was hit by a data breach after mistakenly sending out a full list of passengers’ personal details by text message this morning, we can reveal.
A blunder saw the details of 432 passengers travelling on the 12pm P&O ferry from Calais to Dover sent as an attachment in a customer services text message.
The message seen by This is Money and the Daily Mail was sent on one of the busiest travel days of the year, as holidaymakers return from trips at the end of the school holidays.
It stated: ‘Hello. For your latest P&O Ferries update please view this attachment.’
The attached file contained a spreadsheet with a passenger list for the crossing, which included names, customer IDs, booking numbers, email addresses and phone numbers.
P&O Ferries sent an entire boat load of passengers’ personal details out by text
A passenger, who asked to remain anonymous, alerted This is Money to the breach.
The mother-of-three, who was travelling back to her home in Kent, said: ‘This is a serious data breach and I am not happy my contact information has been shared with hundreds of passengers.
‘Sending out the full passenger list via a text message is an astonishingly reckless misuse of people’s personal details. How on earth have they managed to do this?
‘I am worried about the knock-on effect of my email, phone number and other details now potentially ending up in the hands of scammers.’
This is Money has contacted P&O Ferries for comment but had received no response at the time of publication.
The Information Commissioner’s Office (ICO) said P&O Ferries will need to abide by General Data Protection Regulation rules that mean it must look at the data breach and assess the likelihood and severity of the risk, taking into account the potential negative consequences for individuals.
These must include emotional distress, or physical or material damage, such as financial loss, identity theft and discrimination.
An ICO spokesman said: ‘People have the right to expect that organisations will keep their information secure.
‘Organisations must notify the ICO within 72 hours of becoming aware of a personal data breach, unless it does not pose a risk to people’s rights and freedoms.
‘If an organisation decides that a breach doesn’t need to be reported they should keep their own record of it, and be able to explain why it wasn’t reported if necessary.’
The P&O Ferries mishap follows a major data incident last week, where hackers got personal data belonging to 8.7million people by targeting one of Britain’s largest airport operators.
Stansted, Manchester and East Midlands operator Manchester Airports Group revealed hackers accessed data relating to car park, lounge and fast track bookings and in-airport wifi sign-ups for all three airports. The data included people’s email addresses, phone numbers, vehicle registration details and postcodes.
A spokesman for MAG said the hack was restricted to email addresses for the ‘vast majority’ of customers affected and the security incident did not reveal any bank details.
P&O Ferries is owned by Dubai-based DP World and runs passenger and freight services between Britain and France, Netherlands and Belgium, also offering crossings between the mainland and Northern Ireland.
P&O Ferries is a separate company to P&O Cruises, which is owned by cruise giant Carnival.
Are you a P&O Ferries passenger who has been sent other people’s details? Tell us more at editor@thisismoney.co.uk