Virgin Media Limited

Virgin Media Limited left a marketing database containing personal data of approximately 900,000 customers incorrectly configured and publicly accessible online for approximately ten months between April 2019 and February 2020. The ICO found Virgin Media failed to conduct a Data Protection Impact Assessment for the database, failed to apply basic access controls, and failed to maintain procedures for regular security testing — the misconfiguration was discovered not by Virgin Media's own monitoring but by a security researcher. The exposed data included names, home addresses, email addresses, and phone numbers.