A Liverpool man has been found guilty of leaking sensitive, personal data relating to almost 100,000 Morrisons supermarket staff, the Crown Prosecution Service has said.
Andrew Skelton, 43, a senior internal auditor at Morrisons, of Water Street in the city centre, was jailed for eight years after he posted the data on the internet and sent it to newspapers due to a “grudge”.
A jury at Bradford Crown Court heard that Skelton leaked the information in response to a warning he was given after the company found out he used the mail room at Morrisons’ HQ to send out eBay packages.
The data breach cost the Bradford-based company more than £2m to rectify.
Today the jury of seven women and five men found Skelton guilty of fraud by abuse of position, unauthorised access to data with the intent of committing an offence and disclosing personal data, the CPS said.
The trial, which began on Monday, heard that data containing information including salaries, national insurance numbers, dates of birth and bank account details were sent to The Guardian, Trinity Mirror Newspapers and the Bradford Telegraph & Argus last year. It was also uploaded to data-sharing websites.
Prosecutors told the jury the defendant was subjected to disciplinary action in 2013 after a package was found in the mail room at Morrisons’ HQ.
Skelton admitted he had been using the mail room to conduct eBay deals and he was given a warning.
The police investigation into the data breach led to detectives discovering a draft resignation letter that Skelton has written around the time of the disciplinary matter.
The jury heard the letter spoke of the “anger and frustration that had not diminished with the passage of time” and how Skelton had “scant regard” for the firm.
David Holderness, of CPS Yorkshire and Humberside, said: “Andrew Skelton was in a position of considerable trust with access to confidential personal information as senior internal auditor at Morrisons.
“He abused this position by uploading this information, which included employees’ names, addresses and bank account details, on to various internet websites.
“He then attempted to cover his tracks and implicate a fellow employee by using this colleague’s details to set up a fake email account.
“The potential loss to his victims and the sheer quantity of potentially-compromised data was very significant and could have resulted in employees’ identities being stolen.
“The sentence imposed today sends out a very clear message that we will robustly prosecute serious fraudsters such as Skelton who believe they are above the law."
Source: http://www.liverpoolecho.co.uk/