P&O Ferries has acknowledged a data breach after mistakenly transmitting a full passenger list via text message, a security incident that occurred on one of the year's busiest travel days. The error involved the details of 432 passengers scheduled to travel on the 12 p.m. ferry from Calais to Dover.
The leaked information, sent as an attachment in a customer service text, included passengers' names, customer IDs, booking numbers, email addresses, and phone numbers. It is unclear if the breach was isolated to this single ferry crossing or if it affected multiple P&O Ferries services.
The message to passengers stated, 'Hello. For your latest P&O Ferries update please view this attachment.' The attached file was a spreadsheet containing the passenger manifest.
One passenger, who wished to remain anonymous, described the incident as a "serious data breach" and expressed concern about their personal information being shared. "Sending out the full passenger list via a text message is an astonishingly reckless misuse of people’s personal details," the passenger stated, adding worry about potential repercussions such as scams. "I am worried about the knock-on effect of my email, phone number and other details now potentially ending up in the hands of scammers."
P&O Ferries has not yet responded to requests for comment. The Information Commissioner's Office (ICO) stated that P&O Ferries must now assess the data breach in accordance with GDPR rules, evaluating the likelihood and severity of the risk and potential negative consequences for individuals, which can include emotional distress or financial loss.
An ICO spokesperson emphasized that individuals have a right to expect their information to be kept secure. Organizations are required to notify the ICO within 72 hours of becoming aware of a personal data breach unless it poses no risk to individuals' rights and freedoms. If a company decides a breach does not require reporting, it must maintain its own records and be prepared to justify its decision.
This incident follows a significant data breach last week involving Manchester Airports Group (MAG), which operates Stansted, Manchester, and East Midlands airports. Hackers accessed data related to car park, lounge, and fast-track bookings, as well as in-airport Wi-Fi sign-ups, affecting 8.7 million people. MAG reported that the breach primarily exposed email addresses, with no bank details compromised.
P&O Ferries, owned by Dubai-based DP World, operates passenger and freight services between the UK and mainland Europe, as well as services between Great Britain and Northern Ireland. It is a distinct entity from P&O Cruises, which is owned by Carnival.