BBC TV Licensing urges ‘customers’ to check bank statements after data security alert

If you used the TV Licensing website between 29 August and 5 September you may need to check your bank statements for signs of suspicious activity, after the organisation admitted some transactions on the site were not as secure as they should have been.

For a period of around a week, information that was input by ‘customers’ using the website – including names, addresses, emails, sort codes and bank account numbers, though NOT credit or debit card details – was not ‘encrypted’, and therefore was a risk of being seen by others.

BBC TV Licensing says it isn’t aware of anyone’s data actually having been accessed, and it insists there is a “very small” risk of the information having been seen by anyone else. But it is now urgently contacting customers who submitted their bank details during the relevant period and warning them to check suspicious activity on their bank accounts.

Website was down while they upgraded to SSL

What happened?

BBC TV Licensing says that between some point on Wednesday 29 August and around 3.20pm on Wednesday 5 September 2018 some transactions carried out on its website were not encrypted – ie, they weren’t as secure as they should have been.

It says that some information which may have been input into the website during this period, for example, to set up or amend a direct debit, could have been accessed by others, although they would need to have known there was a vulnerability with the website, and have had knowledge on how to view the data.

It appears that the issue with the website’s security was first flagged by blogger Mark Cook last week.

If you gave any information over the phone, this won’t have been at risk, and BBC TV Licensing says its website is now secure.

I used the site during this period – what should I do?

As a precaution, BBC TV Licensing is suggesting you check your bank account to ensure there aren’t any transactions which you haven’t authorised, and to check your direct debits haven’t been amended in any way.

If you spot any suspicious activity on your account, you should contact your bank or building society immediately.

It’s also worth watching out for phishing scams, where fraudsters use information they have about you to send you correspondence – such as emails and letters – posing as somebody else and trying to gain more information.

‘We’re really sorry this has happened’

A spokesperson for BBC TV Licensing said: “While there is no evidence that anyone’s data has been compromised, for a limited period certain transactions carried out on our website were not as secure as they should have been. This has now been fixed.

“While the risk of anyone having seen any of this data is low, because we take data security seriously we’ve written to people who may have sent their bank details to our website during this period to alert them and advise them to speak to their bank if they see any unusual activity. The issue did not affect credit or debit card details which were encrypted throughout.

“We’re really sorry this happened but want to reassure customers that the risk is low and we’ve taken action to ensure it doesn’t happen again. There is no evidence of any attack and we’ve found no evidence of any unauthorised access to information.”