Loyalty manager regrets distress caused

THE general manager of an Ennis-based company at the centre of a major data protection breach, has said he regrets “any distress caused by the criminal attack by an unknown third-party.” He has not, however, commented on the length of time the company stored customer data.

Loyaltybuild, an international firm based on Station Road in Ennis, was the subject of what it described as “a sophisticated criminal attack”, which resulted in the full payment card details of more than 370,000 customers being accessed illegally, the details of an additional 150,000 clients being potentially compromised and the contact details of 1.12 million clients throughout Europe also being taken.

The breach has affected people who availed of SuperValu Getaway Breaks and AXA Leisure Breaks between January 2011 and February 2012.

Customers of ESB Customer Supply (now Electric Ireland), who availed of a similar discounted hotel break scheme between 2007 and 2008, were also affected.

A number of other companies have also notified customers that their details may have been accessed in the incident.

Last week, Ireland’s deputy data protection commissioner, John O’Dwyer told The Clare Champion that companies should not maintain customer data “where it is not justified” and that the maximum time data is held should not exceed 13 months.

Peter Steenstrup, general manager of Loyaltybuild, has posted two open letters on the company’s website in the past week.

In the first, published on Friday last, Mr Streenstrup stated the company was “committed to providing as much information as we are permitted and as quickly as possible. However, this incident is the subject of a serious investigation by the Garda Bureau of Fraud Investigation and we are not permitted to discuss specific details of the breach.”

The company has ceased taking bookings on the website or over the phone.

“We have done this to enable our external data experts to complete their investigation into the attack and to put into place the necessary protections and certifications to give our customers the highest degree of confidence when booking with us in the future,” he stated.

“Our investigation has shown that the breach was quite sophisticated, so it is vital that we work carefully not only to identify potential risks to consumers but also to preserve the evidence that will help the law enforcement authorities identify the perpetrators,” Mr Streenstrup went on.

He said all the company’s clients “are being provided with the full details of the impacted customers and how they are affected. Affected customers have been or will be hearing from our clients in this respect. In addition, we have taken steps with our payment processors to ensure that card issuers can take precautions to protect customers’ card information.”

In the second letter, posted on Monday, Mr Streenstrup stressed the importance of the Irish market to the company.

“The Irish market is extremely important to us, as this is where we founded our business. We currently employ 50 people in Ennis. Since 1999, we have been bringing our short hotel breaks, beloved by Irish families, to the Irish public,” he said.

Mr Streenstrup made no other comment on the Ennis jobs, except to say that “each member of our team is working tirelessly to rectify this situation”.

Nicola Corless