Data breach criminals' threat to publish nudes of woman

A woman whose data was stolen has described how criminals threatened to post naked photos of her online.

Louise, from south Wales, was one of the 500-plus current and former staff of cosmetics giant Shiseido whose data was stolen in a breach.

The fraudsters applied for a loan in Louise's name and then asked her to transfer the cash to them, before making threats when she said no.

Shiseido said it did not know how its employees' data was breached.

Shiseido reported an incident to the data protection regulator the Information Commissioner's Office in March 2022 and told staff there had been a data breach.

Louise - who we are not identifying - is one of hundreds of people who got letters from Companies House saying firms they had nothing to do with had been registered in their names and at their homes.

Hundreds have also had tax rebates applied for in their names and HMRC said it was contacting those affected.

Louise said she first realised something more had happened when she got a call from someone claiming to be from her bank, Natwest.

"They already knew my full name address and postcode and claimed to be from my bank," she told BBC Radio 4's You and Yours programme.

Louise said the man on the phone sounded very reassuring and told her someone seemed to have taken out a loan in her name and asked if that was right.

"I said 'no, no' and went into panic mode," she said.

"But I knew something was wrong and that I needed to hang up the call."

The person on the phone continued being reassuring and said they would call back later.

In the meantime, Louise phoned her real bank to check and sure enough, there was a payment of £3,000 in her account.

She asked the bank if they had phoned her and they said they had not.

Later that day the same "lovely, reassuring sounding" person pretending to be from her bank called Louise back.

"He said 'all we need you to do is send that money back and here's the account, send us that money'."

Louise refused, knowing by now that these were criminals, which is when "it turned a bit nasty".

"He said 'we know where you live... we are coming for you and we are coming to hurt you and your family if you don't give us this £3,000. We will put naked photos of you online'."

Louise said the call left her shaking and feeling "violated".

Another victim, Angela - not her real name - from the West Midlands discovered she had been installed as a director for a company she had never heard of that was registered to an address around the corner from her home.

She went on to the Companies House website and found it straight away.

She said: "I panicked, because firstly I hadn't done any such thing... I wasn't aware of any company or the address it was registered to either.

"When I showed it to my partner he thought I'd been buying off a dodgy website."

Fraudsters claiming to be a tax rebate company have also applied to HMRC for tax rebates, claiming they are acting for hundreds of Shiseido former and current employees.

The employees told You and Yours they had received letters from HMRC saying payments have been made - but to the criminals, not them.

In some cases that rebate was due because the employees were actually owed tax - but in some cases the grounds for the refund were fabricated.

Shiseido, which owns cosmetics brands NARS and Issey Miyake said: "We offered everyone affected free access to credit and identity monitoring service Experian Plus Protection and we have provided regular updates to all affected employees, current and past, with advice and support."

Shiseido also said it obtained a court order to remove the company details from past and present employees' addresses and was in touch with HMRC over the tax rebate fraud.