A data breach at BBC has exposed information belonging to more than 25,000 employees.
The UK media giant said it detected a “data security incident” involving files containing information on BBC Pension Scheme members. The perpetrator copied these files from a cloud storage service, including names, National Insurance numbers, home addresses, and dates of birth.
“It is important to stress that this information did not contain any bank details, financial information, telephone numbers, email addresses, username or passwords and did not involve the Pension Scheme website or our member portal,” the BBC said in a notice.
The company highlighted there’s no evidence of the affected files being misused or that this was a ransomware attack, which is a common method used by organized cybercrime groups to steal large amounts of personal data.
“We sincerely apologize to members affected by this and appreciate this will be concerning. We want to reassure members that the BBC has responded quickly and that the source of the incident has been secured,” the statement reads.
A spokesperson for the pension scheme confirmed that the details of approximately 25,290 people were affected. That’s nearly half of the more than 50,000 members of BBC’s pension scheme, which is one of the largest occupational pension schemes in the UK.
“We take this incident extremely seriously and we want to reassure you that we and the BBC have taken immediate steps to assess and contain the incident. Please be reassured that we have responded quickly and that the source of the incident has been secured,” Catherine Claydon, chair of the BBC Pension Trust, wrote in an email to those affected.
“We are working at pace with specialist teams internally and externally to understand how this happened and take appropriate action. As a precaution, we have also put in place additional security measures and continue to monitor the situation,” the email reads.
The BBC has notified the UK’s Information Commissioner’s Office (ICO) and the Pensions Regulator about the incident.