Aviva employee stole hundreds of customers' details
An employee of Aviva, one of Britain's biggest insurers, accessed the details of 14,000 customers who had made claims for road traffic accidents and then sold on hundreds of their records. The BBC's personal finance programme, Moneybox, has been investigating what happened.
Some of the information that Matthew Cooper stole when he worked for the company was then passed onto a claims company and two solicitors' firms - the police said all the firms were unaware these details had been stolen.
Aviva had to write to tens of thousands of motorists who had recently had accidents warning them that an employee may have illegally taken and sold on their details.
Cooper, aged 28, had already pleaded guilty to fraud by false representation. He was sentenced to 10 months, suspended for 12 months, and ordered to work 180 hours unpaid by Manchester Crown Court.
As his sentence is suspended it means he will only go to prison if he breaks its terms.
His associate, Oliver Simpson, aged 32, and also from Manchester, had pleaded guilty to offences under the Data Protection Act. He was fined £3,000 and ordered to pay £1,000 court costs.
The court heard that Cooper had worked as a claims handler in Aviva's "bodily injury" team.
"Cooper would access records of recent collisions and he would then pass that information to a contact," Det Insp Oliver Little, from City of London Police, told Radio 4's Money Box.
"They would then pass it on to accident management companies who would cold-call people."
From November 2012, Cooper stole information from around 14,000 case files he was able to access - none of which he was actually working on for Aviva, the investigation found.
He sold on hundreds of claims details for £50 a time to Oliver Simpson, who was described as a "data broker" even though he had not registered himself as required with the Information Commissioner.
The police estimate they together made around £20,000 selling the Aviva records.
Det Insp Little says insurance company employees can be lured into stealing data to be sold on, through a whole host of channels.
"Dating websites have been used to make approaches - there are approaches on social media, conversations in pubs."
He says City of London Police have a number of similar current investigations into insurance data breaches.
Cooper handed the stolen details to Simpson who in turn passed it to a Manchester based claims firm called Heyworth Finance.
It used the details to make unsolicited phone calls to customers in order to persuade them into making a claim for personal injury. The police say Heyworth Finance was unaware that the data had been stolen.
The firm has now ceased trading.
Matthew William Hamer, a former director of the company, told Money Box he did not know that Oliver Simpson who passed him the Aviva details was not registered with the Information Commissioner, and so was not allowed to be trading in customer records.
He said he had been contacted by Simpson via the website Linked In. He would not confirm how many customer details he had bought or what he had paid for them.
But he said he was not aware the data had been stolen and had co-operated with the police investigation.
The police investigation found that some customers who were reluctant to co-operate with the firms were subjected to a high number of nuisance calls in an attempt to persuade them to change their mind.
Those customers who agreed to make a claim were handed over to two solicitors' firms who handled the claims on their behalf; Silverbeck Rymer in Liverpool, and Gavin Edmondson in Northwich.
When Money Box contacted Gavin Edmondson, the firm refused to discuss its relationship with Heyworth Financial.
In a statement, it said: "Gavin Edmondson Solicitors had no knowledge or any suspicions of any irregularities of any cases transferred to our firm. We fully co-operated with the police in their investigation. We deplore any illegal act and actively seek to stamp out any wrong doing."
Silverbeck Rymer is now called Slater Gordon Solutions, part of the Slater and Gordon Group. A spokesperson for Slater and Gordon, said: "We co-operated fully with the police investigation and suspended our arrangements with Heyworth Finance.
"We were informed by the police that Heyworth Finance were not implicated in any wrong-doing. We continued to work with them until June 2015. We have not received complaints about data misuse from any clients introduced to us by Heyworth Finance. "
The police said they identified that cash deposits totalling thousands of pounds started being paid into Cooper's account in November 2012.
Customers started to complain about claims calls in early 2013.
Aviva for some time dismissed suggestions that it was the source of the data. It took until September 2013 until Cooper was interviewed by Aviva and the fraud was uncovered.
And only then could the firm start to alert customers.
Andrew Morrish, claims operations director, Aviva, said, "We are pleased the two individuals have been brought to justice but it is not for Aviva to comment on whether the sentences handed to the pair are sufficient deterrent for a crime that causes so much upset.
"Stealing accident data in order to reap obscene profits for personal injury claims highlights the dysfunctional way the current claims system operates.
"Aviva has a zero-tolerance attitude towards data theft, and we will work tirelessly with the police, the ICO (Information Commissioner's Office) and others to bring to justice those that commit a crime by stealing our customers' data."