Re: Important information regarding a data security incident in relation to the BBC Pension Scheme

We are writing to inform you about a data security incident involving files containing BBC Pension Scheme records. Unfortunately, these contained some of your personal data, and we are writing to explain what has happened, how we have responded, and what this means for you.

We sincerely apologise that you are impacted by this and we appreciate it will be concerning. It is important to stress from the outset that this information did not contain any financial information, telephone numbers, email addresses, or passwords, and did not involve the Pension Scheme website or our member portal: myPension Online or existence checking service: myPensionID. It is also important to tell you that analysis undertaken by our specialist teams currently shows no evidence that the affected files have been misused.

What has happened?

The BBC's information security team has alerted us to a data security incident in which some BBC Pension Scheme records were copied from an online data storage service used by our administration team. Based on the information currently available to us, we have established that the following information about you was included in the records copied:

An indication that you are a member of the BBC Pension Scheme;
Your name, date of birth, and sex;
The home address(es) we held for you between 13 November 2023 and 1 February 2024; and
National Insurance number (if we hold one for you).
We can confirm this information does not contain any bank details, financial information, telephone numbers, email addresses, usernames or passwords, nor any sensitive data about your health or your nominated dependant(s).

This is precisely why I did not (and will not) sign up for My Pension on the web, despite assurances that it's absolutely safe.

When will people realise that nothing is safe on the internet!

I doubt if not signing up for "my pension" online would have helped!
It was the Pension schemes own system that was hacked, so even members totally "off line" would have been affected.
Sadly this seems to be part of modern life!

For anyone who hasn't seen the BBC Alumni response to this matter ...

"The BBC’s Information Security Team alerted us to a data security incident, in which some files containing personal information of some BBC Pension Scheme members were copied from a cloud-based storage service.
The files include some Pension Scheme members’ personal information - including details such as Names, National Insurance numbers, Dates of Birth and home addresses.

It is important to note that this information did not contain ...

any telephone numbers,
email addresses,
bank details,
financial information,
usernames or passwords

The breach did not involve the BBC Pension Scheme website, or its member portal myPension Online, or the 'existence checking service' myPensionID.

It is also important to note that analysis undertaken by our Specialist Teams currently shows no evidence that the files affected have been misused."