Cyber Incident Victim: Wentworth Club
Date:
Jan 2021
Location:
United Kingdom
Summary
The Wentworth Club experienced a cybersecurity incident involving unauthorized access by a third party, resulting in the theft of membership data. The breach affected over 4,000 individuals, including high-profile members, whose personal details were compromised. The organization notified all impacted parties, advising vigilance and issuing an apology for the incident, though specific types of exposed data were not publicly detailed. The club, known for its affluent membership base, emphasized the unauthorized nature of the intrusion but did not disclose the attack's methodology or broader operational consequences.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On or around January 17, 2021, the Wentworth Club, an exclusive golf club in Surrey, United Kingdom, and host venue for the European Tour, experienced a cybersecurity incident involving unauthorized access to its membership data. An unidentified third party infiltrated the club's systems and exfiltrated sensitive member information. The club's membership roster included over 4,000 high-profile individuals from sports and entertainment sectors, such as television personality Sir Michael Parkinson, former cricket professional Kevin Pietersen, and golf professionals Nick and Di Dougherty. Club management discovered the breach and formally notified all affected members through written correspondence distributed at the end of the week preceding January 17. This notification contained an apology for the security failure and confirmed that personal member details had been stolen during the intrusion.
The breach compromised membership data, though specific data categories beyond general "details" were not publicly disclosed in available reports. The club advised all members to exercise heightened vigilance regarding potential misuse of their personal information, indicating concerns about identity theft or financial fraud risks stemming from the incident. No operational disruptions to club facilities or golf events were mentioned in reporting. The incident drew attention due to the club's affluent and internationally recognized membership base, increasing scrutiny of its data protection measures. Wentworth Club did not release technical details about attack vectors, forensic findings, or remediation steps taken following the breach. No ransomware claims or extortion attempts were referenced in initial disclosures. The breach notification represented the primary documented response action, with no subsequent public updates regarding law enforcement involvement or member support services beyond the initial vigilance advisory.