English Premier League club West Ham United appears to have (accidentally) leaked personal data fan on its official website, meaning fans are currently exposed to phishing and other attacks.
It is said that information including full names, dates of birth, telephone numbers, home addresses and email addresses appeared when fans tried to log into their accounts on West Ham United's ticketing site.
According to fan comments on forums, the official site was displaying several error messages yesterday, including an admin message stating that “Drupal is already installed.” When users tried to reconnect to their accounts, they saw other fans’ details.
West Ham United later said the issue had been resolved, with a spokesperson saying: "We are aware that there was a technical issue when logging into online accounts this morning. We have worked with our service provider and they have now resolved this issue."
There is currently no evidence to prove that credit card details and other financial data.
Security experts believe the data leak was likely caused by an internal error.
Javvad Malik of KnowBe4, which works on cybersecurity awareness and information, commented: “All organizations of all sizes and across all industries need to cultivate a cybersecurity culture so that all aspects of security and design are taken into account. The leak at West Ham United club was likely due to an internal error or misconfiguration, which is quite easy to do. This is why it is important to have appropriate security controls in place, especially when we are talking about data , to ensure that the data is being managed properly.”
In accordance with GDPR, West Ham United must immediately contact fans whose information was exposed. In the meantime, all fans should be very careful with any messages or emails they receive in the future.
Natalie Page, threat analyst at Talion, said: “The potential impact on West Ham United from this incident could be extremely costly. Since the introduction of GDPR, we have seen organisations receive fines of up to £42m.” As for fans, the expert said they should act as if their data has indeed been breached and take appropriate action until they are informed by the authorities.
“Be wary of incoming messages, calls, and emailsfrom unknown sources that use information shared in this event and request further personal information or payments. Also, consider the password . you use for this account. If it has been used on other personal accounts, it should be changed immediately“.
Source: Infosecurity Magazine
