https://celsolicitors.co.uk/fi...
If anyone is wondering why the share price is dropping…
“Cake Box, which makes egg-free celebration cakes, is currently writing to its customers to warn them of a serious data breach, in which their payment information was compromised, in April last year.”
Personally, if that is true, it does not look good that it’s taken over 1 year to inform the potentially affected customers.
Martin
Life changed by leaving the 'City' and living in the foothills of the Auvergne Mountain range. Living a Tech/Green lifestyle. Found mostly with an iPad in one hand, investing in stocks, while picking crops in our field, with the other hand… more »
Yes. I don't know what to think here. I do think it is a well run company with a good future and perhaps there was some unfortunate oversight in the way they are dealing with the issue. They have only been listed a couple of years and perhaps are learning on how to deal with these types of issues. I did buy some Cakebox recently. Of course, no-one is sure about the future. My personal hunch is that they can recover from this episode. Indeed all/most organisations are susceptible to this kind of thing, one would think.
I understand how you feel and agree the future of the Company, has/had a positive outlook.
I guess its down to the part, if they really kept the info to themselves, re data breach, without informing their customers. That to me, if true, is more worse than the data breach.
I did have shares until 15 mins ago, but sold, with a +13% profit. Watching this Company and the news story and might reconsider, after the dust has settled.
One guesses that all companies will watch and learn from this on how to handle this sort of situation in the future. This certainly won't be the last time we see this sort of thing happening in the world.
The ICO have the power to fine companies up to 4% of global turnover or (roughly) £17 million, whichever is the higher. Sitting on a known data breach while not notifying customers is a GDPR breach.
The statement this morning includes the statement:
"It confirms that it has recently emailed customers in relation to a data breach experienced in 2020 as a result of which personal and financial information may potentially have been accessed".
https://www.investegate.co.uk/...
At face value that says that they knew about the breach at least six months ago but have only recently informed customers. That is a breach of GDPR principles.
They also state:
"The Company is in the process of finalising a date for its 2021 full year results with its auditors and expects to confirm a date shortly. The Company confirms that the data breach is not expected to have a material financial impact and as per the announcement on 12 April 2021, full year results are expected to be in line with market expections".
That would also be true, because any ICO fine will be months away. But it says nothing about the eventual impact.
The ICO has so far been unwilling to use the full extent of its powers, so it'll be interesting to see what sort of action it takes here. It probably depends on whether the data lost could have been used to defraud their customers and what mitigation they're offering.
timarr
https://celsolicitors.co.uk/financial-woe-for-cake-box-customers-after-serious-data-breach-exposes-payment-information/
Cake Box certainly sounds like customers affected, bigger drop expected once news filters out I wonder
I wouldn't quite say that... Agreed its not 4% of global turnover but British Airways, Marriot and Ticketmaster all had 7 or 8 figure penalties in the last year or two.
I wouldn't quite say that... Agreed its not 4% of global turnover but British Airways, Marriot and Ticketmaster all had 7 or 8 figure penalties in the last year or two.
True, but they're all high profile cases. The ICO has only levied a handful of fines since GDPR came into force. Whether that's because they prefer to encourage rather than punish or because they don't have the resources to pursue cases or something else isn't clear.
However, GDPR does open up the possibility of being sued for consequential damages. So if someone can prove that the Cake Box breach led to them losing money - perhaps by using the breached details for identity fraud - then they're open to unlimited court imposed fines. That kind of thing is hard to prove although not impossible.
Most likely this won't lead to any consequences, but it is interesting to see that the ambulance chasing lawyers are on the case. It's an obvious area for them to pursue when the failure is obviously egregious.
timarr
The RNS about the security breach prompted me to have another look at my Cake Box Holdings (LON:CBOX) holding - the company's follow-up when the share price fell reiterated that trading was 'in line' and not better. For me that means the current price is fully baked in. (Sorry.) What I didn't like were the poor recent reviews for the product on trustpilot - for every good one there seems to be another saying how dreadful they are. Maybe it is a well run show - but you are only as good as your product and, with this model, a lot rests on the quality of your franchisees. The multiple is demanding enough to make me think again and for the moment I'm out, having taken a small profit.
I think a lot depends on taste. And when it comes to food many Brits lack it. Having lived in Germany for many years, I was shocked the couple of times I went into a Greggs at how terrible the quality of everything was... such a bakery wouldn't last a day in a country where people know quality vs rubbish. Yet it has thrived in the UK.
