Arnold Clark data breach

[BuzzBravado]

I've just been notified by AC that my data is likely part of that taken in a recent data breach. This is quite concerning as along with banking details they also held personal details including passport and driver licence details.

https://www.arnoldclark.com/security-update

So far they have offered a free subscription to an Experian Credit checker thing, but i don't see how that will stop someone using my identity. I can change my bank account, my passport and possibly my drivers licence, but i cant change who i'am or where i live.

Is anyone else in the same boat with the AC data breach? Apparently it involves finance agreements made 2019 and earlier.



Thanks

Edited by BuzzBravado on Thursday 16th February 10:30

[MondeoMan1981]

I've finally got confirmation from them I was part of the leak.

If they think 24 months Experian access is going to cut it they have another thing coming.

I'll be joining a class action.

Data security isn't difficult and leaks shouldn't occur to this extent.

[EdmondDantes]

You can add a password to your credit file, this will automatically refer any credit applications etc and the providers will then need to call any telephone number on the application.

Then any suspicion around unable to confirm the financial institutions will prompt further investigation to check the worthiness of the application,

[BuzzBravado]

Does that need to happen with each credit agency? After i set a credit lock with Experian I was able to open a credit account with Very, unhindered and with the details that will now be in the wrong hands. What's more this new account doesn't even show up with Experian.

[hiccy18]

Can't help wonder if running all their systems on Windows XP would have contributed to this.

[Raptor7000r]

Can confirm I got the same email recently, also worth noting this breach happened around Christmas time and they had to resort to pen & paper for customers.

Quite disappointed it took so long to receive the email but I was told it was really bad.

[Gibby88]

The wife and I also had our seperate emails.

Not surprising given they smeared silicone round my leaking windscreen, instead of refitting it. That was their attempt at a Ford approved warranty claim!

A shambolic company and I will be glad to put my compo' face on for the class action heehee.

[jeremyh1]

I think you lot and your modern day drama is a joke
You poor timid souls and your precious data
Please God I hope you show a bit more balls when the Russians attack!

I don't even get the obsession with data and credit files.
Never bothered me and I am worried about you missing out on life nannying over these stupid things

[mikebradford]

Never bought from them, however did start the purchase.
I wonder if those types of initial transactions will be involved.
Only placed a deposit.
Car ultimately was not as advertised so I was refunded

[deja.vu]

jeremyh1 said:

I think you lot and your modern day drama is a joke
You poor timid souls and your precious data
Please God I hope you show a bit more balls when the Russians attack!

I don't even get the obsession with data and credit files.
Never bothered me and I am worried about you missing out on life nannying over these stupid things

It’s a little pathetic isn’t it.
Mondeo man is clearly hoping for a big pay out

[LuckyThirteen]

Data breach = hurt feelings

And in this day and age, hurt feelings are worth more than a sense of self worth.

[Gibby88]

deja.vu said:

jeremyh1 said:

I think you lot and your modern day drama is a joke
You poor timid souls and your precious data
Please God I hope you show a bit more balls when the Russians attack!

I don't even get the obsession with data and credit files.
Never bothered me and I am worried about you missing out on life nannying over these stupid things

It’s a little pathetic isn’t it.
Mondeo man is clearly hoping for a big pay out

My car was a Focus but I am happy to take the thoughts and prayers though.

[vikingaero]

deja.vu said:

jeremyh1 said:

I think you lot and your modern day drama is a joke
You poor timid souls and your precious data
Please God I hope you show a bit more balls when the Russians attack!

I don't even get the obsession with data and credit files.
Never bothered me and I am worried about you missing out on life nannying over these stupid things

It’s a little pathetic isn’t it.
Mondeo man is clearly hoping for a big pay out

I couldn't care less if anyone gets a payout. Maybe companies should wake up and pay a bit more for online security than the bare minimum?

[Gibby88]

It is crazy that any company still retains a customer's passport, driving licence and payment details, 4 years after the purchase.

[Baldchap]

It won't be the first data breach for any of you.

Now's the time to adopt a decent password strategy.

How many of you use the same password for everything? Including your email account that allows password resets for things like banking?

This is the big issue. Your hacked details aren't actually particularly useful unless your own practices are flawed (which for most of you they will be).

Go change some passwords. If it helps you remember, get some sort of system to help you, be it a password manager or a system in your own brain (my preference), but make sure the same password isn't used everywhere. Certainly make sure the password you use with things like emails and Amazon aren't propogated across the internet and are unique. Other alternatives including using unique email addresses for each online service you use (surprisingly easy).

Companies have been and will continue to be hacked. You personally are ultimately responsible for your data security.

[Baldchap]

Gibby88 said:

It is crazy that any company still retains a customer's passport, driving licence and payment details, 4 years after the purchase.

I believe data retention requirements for financial transactions are six years.

[EdmondDantes]

For OP,

https://www.cifas.org.uk/pr

[Gibby88]

Baldchap said:

Gibby88 said:

It is crazy that any company still retains a customer's passport, driving licence and payment details, 4 years after the purchase.

I believe data retention requirements for financial transactions are six years.

Wow I did not know that. Is that for money laundering regulations? Seems a bit excessive for a used car.

I find the best approach is to use a unique password for every page then go through the process of forgetting it and resetting my password everytime I need in!

[Baldchap]

Gibby88 said:

I find the best approach is to use a unique password for every page then go through the process of forgetting it and resetting my password everytime I need in!

One way to prevent password propagation without forgetting every time is to start with a base password and modify it using the domain name. For example:

Ba5ePa55w0rd!

On Google:
GoBa5ePa55w0rd!

On Amazon:
AmBa5ePa55w0rd!

On Pistoheads:
PiBa5ePa55w0rd!

Obviously make it slightly less obvious than that, be as creative as you want/can, but using a system like this you can always calculate your password without using the same one for everything.

[MB140]

I hope Arnold Clark get bent over and reamed good and proper. No way should they be storing all that information for that long in the first place. Moreover why wasn’t it encrypted.

I hope those of you who have had your data breached and now have to spend you hard earned free time sorting out their mistake do get compensated (you should).

Reference passwords. I have my own mental way of generating passwords using certain letters of a websites URL. The number of letters in a company name and some special characters at a certain number of points in the password. For example 2nd, 4th, 6h, 8th character. When forced to change to a new password the key character is a number. So I just keep a list on my phone with what the website is and what the number at the end is. The rest I can work out from the URL and the website name.

There are other methods available, this is just my way.