CIVIL SERVICE SPORTS COUNCIL (CSSC) QUESTIONS & ANSWERS

Transcription

1 CIVIL SERVICE SPORTS COUNCIL (CSSC) QUESTIONS & ANSWERS ABOUT THE INCIDENT How did it happen? Related frauds are being investigated by the relevant authorities and criminal proceedings may result so we can t comment on the details at this time. What has happened in this case? There is evidence that some members personal details have been stolen from our IT system without our authority. The matter is the subject of a criminal investigation and we have been advised that some of these details may have been used to make fraudulent claims against the Government. We do not know which identities have been used. How was the fraud discovered? The matter was drawn to our attention by the statutory investigating authorities. Who are the statutory investigating authorities? They are the authorities concerned with criminal investigation and data protection. Has someone been arrested? We are unable to tell you any more about this as it is part of an on-going criminal investigation. Who stole the data? We are unable to tell you any more about this as it is part of an on-going criminal investigation. When will the case come to court, and which court? We are really sorry, but we do not have that information. Will I be required to be a witness? That is unlikely. Have the police been informed? Yes

2 ABOUT THE INFORMATION THAT WAS STOLEN What information was taken? There is evidence that names, addresses, National Insurance numbers, and dates of birth were stolen. Has any financial information been stolen? We only hold financial information for those members who pay by direct debit. There is no evidence that any financial information provided to us was involved but we cannot rule out the possibility. Were any details stolen of who I am employed by? There is no evidence that this information was stolen but we cannot rule out the possibility. What information has been used to commit these frauds? We understand that it was name, date of birth, and National Insurance Number. We do not know whose details were actually used, but we know that some records were stolen. What has it been used for? We know that some identities have been used for attempted fraud against the Government. If your identity has been used for this purpose you will have received a letter concerning this from the relevant Government department. Has the information been used for anything else? Not as far as we are aware. Why can t you tell me if my details were stolen? We are not able to say because of the likely court proceedings. How many records were stolen? We don t know that information. What might I have lost? There is no reason to suspect that you have lost anything. Can it happen again? We take our responsibility to protect members data extremely seriously. Following the theft we engaged a security expert to review our data storage and handling processes and immediately implemented a robust new security system to prevent anything like this happening again.

3 ABOUT NOTIFYING MEMBERS When did it happen? CSSC was identified as the probable source of the data theft in February Why didn t you tell me about it then? When the theft was first identified, we had evidence relating only to a small part of our membership records. There was no evidence of any risk to individuals, since the fraud concerned attempts to defraud central Government rather than individuals. We took the advice of the relevant authorities which was that no purpose was served by notifying members at that time. Why have you written to me now? Investigations have now revealed that our full membership database could have been stolen and we have decided that members would want to know about the theft. We felt it was in our members best interests to make you aware of the situation as soon as we were able to do so. I joined CSSC after February Am I affected? No. We were notified of the theft in February 2010 and immediately implemented a robust new security protocol. Any member who joined after 1 March 2010 is not affected. I have not received a letter from you. Am I at risk? If you joined after 1 March 2010 your data was not part of this theft. I joined before 1 March 2010 and haven t received a letter; why not? We are very sorry if our mailing has missed anyone who might be affected by this incident. We will need to check our records to find out why that has happened. Please use the dedicated [email protected] to notify us; please include the following information: CSSC membership number, full name, address, and telephone number(s) and we will contact you as soon as possible. I am an ex member of CSSC why have you still got my details? We kept your data because from time to time we contact ex members to invite them to re-join. Since February 2010 we have had to keep the data as it is evidence in a criminal investigation. You wrote to a relative who has died. I am really upset about this. We are very sorry that this has happened. We would not knowingly write to anyone who we knew had passed away. Unfortunately we may not have received any notification of the sad loss of your relative. Please use the dedicated [email protected] to notify us; please include your relative s CSSC membership number (you will find this at the top of the letter). We will note the record and remove it from our database once the investigation is closed.

4 ABOUT IDENTITY FRAUD Is there anything that I need to do to protect my identity? There is no specific action that you need to take as a result of this fraud. If by any chance you notice anything unusual that leads you to believe that your details may have been used for other purposes, we would ask you to let us know, using the dedicated [email protected] as well as the police. Further information and advice is available from What are the common signs of identity fraud? People might have items on their bank, credit card or other financial statements which they do not recognise. People may receive bills, invoices or receipts addressed to them for goods or services they haven t asked for. A mobile phone contract may have been set up in their name without their knowledge. People may receive letters from solicitors or debt collectors for debts that aren t theirs. People may have been refused a financial service, such as a credit card or a loan, despite having a good credit history. What if my identity is used fraudulently? Please inform us if this happens using the dedicated [email protected] I have suffered identity fraud recently. Could it be down to this theft? It is difficult to prove the source of identity theft but if you think this has happened please use the dedicated [email protected] to notify us; please include the following information: CSSC membership number (you will find this at the top of the letter), full name, address, and telephone number(s) and we will contact you as soon as possible.

5 ABOUT COMPENSATION Is CSSC going to compensate me? At this stage there is no evidence that any CSSC member has incurred any personal loss as a result of this theft. If I incur expenses clearing my credit record, is CSSC going to compensate me in full? We will look at individual cases. ABOUT THE INFORMATION COMMISSIONER Has the Information Commissioner been advised? Yes, they have been fully informed. Do I need to contact the Information Commissioner? We have kept them fully informed but it is your decision whether you wish to.