Vodafone Germany discloses details about data breach affecting 2m customers

Vodafone Germany apologised after hackers stole data stored on its servers, including customers' names, addresses, dates of birth and gender, as well as sort codes and account numbers. However, it said the perpetrators did not have access to credit card information, passwords, PIN numbers, or mobile phone numbers and so could not directly access customers' bank accounts.

The company said that "insider knowledge" was required to carry out the attack. It said police had identified a suspected and conducted a search. It warned customers to be vigilant for fake emails and other "phishing attacks" used by hackers to steal other information needed to access their bank accounts.

"The security of data is a top priority for Vodafone," Vodafone Germany said in a statement, according to an automated translation. "The company has IT systems that meet the highest possible standards. These are regularly updated and expanded. Vodafone will take all necessary steps to further improve the security of the systems and to protect them from future criminal attacks."

The EU's Regulation on the notification of personal data breaches telecoms companies are obliged, under certain circumstances, to inform both regulators and customers about personal data breaches.

The companies have to supply the regulator – generally within 24 hours – with a range of information about the breach, including the estimated date and time of the incident, the nature and content of the personal data concerned and how many individuals are affected.

The telecoms providers also generally have to notify individuals affected by a personal data breach "without undue delay" in cases where the breach is "likely to adversely affect the personal data or privacy" of those individuals.

Factors such as the type of personal data that has been breached, the likely consequences of the breach for individuals, and the circumstances of the breach, such as whether the data has been stolen or where the provider knows the information is in the hands of an unauthorised third party, should be assessed to determine where a breach is likely to adversely affect individuals' privacy, according to the Regulation