Alleged film sharers' details leak may see ACS:Law fined

The firm behind a leak of the personal details of more than 5,000 broadband customers accused of illegally sharing adult films online could be fined up to £500,000, the Information Commissioner said today.

The list, produced by ACS:Law, which is targeting online pirates, was posted on the internet following an attack on the firm's website.

It contained the names and addresses of more than 5,300 Sky broadband customers alleged to be illegally sharing adult films online.

Information Commissioner Christopher Graham told BBC Breakfast: "The question we will be asking is how secure was this information and how it was so easily accessed from outside.

"We'll be asking about the adequacy of encryption, the firewall, the training of staff and why that information was so public facing.

"The Information Commissioner has significant power to take action and I can levy fines of up to half a million pounds on companies that flout the (Data Protection Act)."

A spokesman for the Information Commissioner's Office (ICO) added that all breaches of the Act were taken "very seriously".

"Any organisation processing personal data must ensure that it is kept safe and secure. This is an important principle of the Act.

"The ICO will be contacting ACS:Law to establish further facts of the case and to identify what action, if any, needs to be taken."

Andrew Crossley, who runs ACS:Law, told BBC News: "We were the subject of a criminal attack to our systems. The business has and remains intact and is continuing to trade."

A Sky spokesman said: "We are very concerned at the apparent security breach involving data held by ACS:Law.

"At this stage of our investigation, we believe that the data included the names and addresses of around 4,000 Sky Broadband customers.

"Like other broadband providers, Sky can be required by court order to disclose information about customers whose accounts are alleged to have been used for illegal downloading.

"We only ever provide such data in encrypted form and we never disclosed credit card or bank details to ACS:Law."

In a statement to customers on its website, Sky added that the law firm was "involved in legal action against alleged illegal downloading" and said that, while the leak did not involve a loss of data at Sky, it was investigating the issue.