High street chain Dixons Carphone has been fined half a million pounds for a cyber attack that left millions of customers at risk.
The company has been ordered to pay £500,000 by the data watchdog after hackers harvested the card details and personal information of a number of shoppers.
The Information Commissioner's Office said the data of 14million people was compromised over a nine-month period between July 2017 and April 2018, when the cyber-attack was finally detected.
Its probe found that malicious software called 'malware' was installed in 5,390 tills at the company's Curry PC World and Dixons Travel stores.
It's believed 5.6 million payment card records used in transactions were accessed as a result, as well as full names, postcodes, email addresses and information related to failed credit checks.
The group was criticised for its careless security arrangements and for failing to protect customers' data, meaning it fell foul of data protection laws.
Lapses included failing to update software to get rid of bugs and glitches and not carrying out proper security testing.
The regulator fined the firm £400,000 in January 2018 over a separate hack in 2016.
As the incident occurred prior to the introduction of the General Data Protection Regulation in May 2018, the case fell under the Data Protection Act 1998, which stipulated a maximum fine of £500,000.
However, under new laws, the retailer would have been subject to a potential fine of up to 4% of annual turnover, or £17million.
Carphone Warehouse itself was also fined in January 2018 for similar vulnerabilities, to the tune of £400,000.
