Central Bank of Ireland suffers credit data breach

The Central Bank of Ireland has admitted an “archiving error” may have affected the credit scores of tens of thousands of borrowers, as old data remained on file. 

The Central Credit Register (CCR) contains information on whether borrowers made repayments on credit agreements worth €500 or more, such as loans, overdrafts, credit cards and mortgages. 

Between June 1 and August 7, the credit scores of 20,500 borrowers were calculated using data older than the five-year retention period. 

This “constitutes a data breach under data protection legislation”, the central bank said in a statement issued on August 21. 

The central bank was made aware of the problem by a member of the public, who made an enquiry on August 3. “Remediation began on August 4 and the error was fully resolved on August 7,” the central bank said. 

The central bank said a “technical error” meant the old records were not automatically deleted. “We wish to state clearly that borrowers’ data has not been compromised or accessed by any unauthorised third parties as a consequence of this error,” the central bank said. 

Borrowers may have been adversely affected by the error if lenders refused to extend new credit due to historical repayment difficulties that should not have been part of the decision-making process. Borrowers themselves may also have chosen not to seek new credit agreements, the central bank said. 

A key focus of the central bank’s ongoing investigation is “to establish whether any borrowers were impacted by this incident”. Those who made applications between June 1 and August 7 “may also wish to engage with relevant lender”. A total of 476,000 enquiries to the CCR were made during this period. 

The Central Bank of Ireland said it has notified the Data Protection Commission and is continuing to engage with the supervisory authority. 

“Once we have a clearer view of the nature and extent of impacts on borrowers, the central bank will seek to communicate directly with those most likely to have been affected,” it said.