Personal information of job applicants leaked in Costa Coffee data breach

The parent company of Costa Coffee, Whitbread, has been the subject of a data breach which has seen personal information of job candidates exposed.

A cyber attack was carried out on Whitbread’s recruitment agency, PageUp, potentially leaving data including home address, email address, telephone number, maiden name, date of birth, and country of residence open to data thieves.

The intrusion first hit on May 23 however it only realised on May 28 that a malware attack had occurred. Last month the company confirmed there was no longer an active threat on the system, and said it had notified the UK Information Commissioner’s Office regarding the data breach, however it is unclear when Whitbread and other clients became aware of the incident.

Costa applicants hit by the breach, including some who claim they applied years ago, have confirmed on Twitter they were sent an email by Whitbread telling them their data had been exposed.

https://twitter.com/LothianKatie/status/1013862695219748864

https://twitter.com/mbellgb/status/1013789018293702661