The short version is that Carphone Warehouse had a very outdated copy of Wordpress, a database with no encryption of passwords, a generally sloppy infrastructur

The short version is that Carphone Warehouse had a very outdated copy of Wordpress, a database with no encryption of passwords, a generally sloppy infrastructure security-wise, and you can pretty much guess the rest of the story. While I agree with many others that this is a small fee all things considered, it does put other companies on notice: secure your shit or you'll be held liable (to some degree at least).