Since the cyber attack on our website on Wednesday 21st October 2015, we have been working with the Metropolitan Police Cyber Crime Unit and world leading cyber crime and security experts, to establish what happened and to understand the extent of the data stolen during the attack. Our investigation continues, but we now know the extent of the data accessed is significantly less than originally suspected.
We can now confirm that the following personal data were accessed:
• Less than 21,000 unique bank account numbers and sort codes.
• Less than 28,000 obscured credit and debit card details. As previously stated, the middle 6 digits had been removed and therefore are not usable for financial transa_ctions e.g. 012345 xxxxxx 6789.
• Less than 15,000 dates of birth.
• Less than 1.2 million email addresses, names and phone numbers.