Firm possibly lost 50,000 clients' data

PHOENIX IRELAND, a life and pensions company, has admitted it may have lost the personal details of about 50,000 current and former customers. The possible data loss also affects a small number of people who contacted the company, formerly Scottish Provident Ireland, but did not take out a policy.

In letters sent this week, Phoenix told the affected individuals that a “tape” containing their personal data held on its systems had been misplaced.

It is understood that in most cases, this data, which was not encrypted, included customers’ names, addresses and bank account details. There is a small risk, customers were told, that fraudsters could obtain the tape, decipher it and use it for purposes such as applying for credit.

A spokesman for Phoenix said yesterday that it viewed this risk as “low-level”, in part because hacking experts had concluded it would be extremely difficult to distil information from the tape, which was not labelled “Phoenix”.

In its advice to those contacted, the company said: “We believe it would require an experienced IT specialist to be able to understand the data.”

The spokesman also said the company is not convinced the tape was ever actually created; it simply knows it did not arrive when it should have been sent from one office to another.

“It’s very unlikely it was taken to order,” the spokesman said.

He confirmed that about 1,000 of the customers affected are based in the UK, with the remainder in the Republic. Most are past rather than current customers.

Phoenix has informed the Data Protection Commissioner and the Financial Regulator, as well as their UK equivalents, of the issue and it is under investigation.