FCA issues statement on data breach

The UK Financial Conduct Authority (FCA) today issued a statement regarding information disclosed “by mistake” in November 2019.

The FCA says it was recently made aware that, in a response to a Freedom of Information Act request published on the FCA’s website in November 2019, certain underlying confidential information may have been accessible. The response related to the number and nature of new complaints made against the FCA and handled by the Complaints Team from January 2, 2018 and July 17, 2019.

“The publication of this information was a mistake by the FCA”, the regulator says.

The FCA has removed the relevant data from its website and has undertaken a full review to identify the extent of any information that may have been accessible. In many instances, the extent of the accessible information was only the name of the person making the complaint, with no further confidential details or specific details of their complaint.

However, there are instances where additional confidential information was contained within the description of the complaint, for example an address, telephone number, or other information. Where this is the case, the FCA is making direct contact with the individuals concerned to apologise and to advise them of the extent of the data disclosed and what the next steps might be.

No financial, payment card, passport or other identity information were included.

The FCA has referred the matter to the Information Commissioner’s Office.

In January 2020, the FCA issued a warning against the Raid Forum website which claims to be offering FCA data for sale. The regulator said back then it believes that this information has been improperly obtained from third parties. Based on the regulator’s detailed assessment, it believes that there has been no compromise of its systems or of data held by the FCA.