Cyber Incident Victim: Butlins
Date:
Aug 2018
Location:
United Kingdom
Summary
Butlins experienced a cybersecurity breach compromising approximately 34,000 guest records, with attackers accessing names, holiday dates, postal and email addresses, and telephone numbers, though no financial data was stolen. The incident stemmed from a suspected phishing attack, prompting the company to notify regulators within mandatory reporting timelines and establish a dedicated team to directly inform affected guests. Management issued an apology, emphasized improved security protocols, and cautioned customers against potential fraud attempts leveraging the stolen information, while internal investigations found no evidence of fraudulent activity linked to the breach.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The Butlins data breach occurred within a 72-hour window prior to August 10, 2018, when unauthorized actors accessed guest records through a phishing email attack. The compromised data included names, holiday booking dates, postal addresses, email addresses, and telephone numbers for approximately 34,000 customers. Butlin's confirmed no financial or payment details were exfiltrated during the incident. The company identified the breach through internal investigations and promptly notified the UK Information Commissioner's Office (ICO) in compliance with GDPR's 72-hour reporting mandate. Butlin's publicly disclosed the incident on August 10, 2018, emphasizing that their forensic review had not uncovered evidence of fraudulent activity stemming from the breach. The phishing vector indicated human error or insufficient email security controls as the initial compromise pathway.
Butlin's response included establishing a dedicated communications team to directly notify potentially affected guests about the breach scope and protective measures. Managing Director Dermot King issued a public apology while asserting enhanced security processes were being implemented. The company advised customers to verify the authenticity of any follow-up communications claiming to be from Butlin's, warning that fraudsters often exploit breach announcements for secondary scams. No system downtime or operational disruptions were reported beyond the data access incident. The breach exposed non-financial but personally identifiable information that could facilitate targeted phishing or social engineering attacks against affected guests. Butlin's maintained throughout their communications that financial systems remained uncompromised and no customer monetary losses had been detected.