Feeds

Oops! Firm accidentally eBays customer database

Financial records? Yours for a fiver

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

A customer database and the current access codes to the supposedly secure Intranet of one of Europe's largest financial services group was left on a hard disk offered for sale on eBay. The disk was subsequently purchased for just £5 by mobile security outfit Pointsec Mobile Technologies.

According to Pointsec, one of the hard disks contained "highly sensitive information from one of Europe's largest financial services groups with pension plans, customer databases, financial information, payroll records, personnel details, login codes, and admin passwords for their secure Intranet site. There were 77 Microsoft Excel documents of customers email addresses, dates of birth, their home addresses, telephone numbers and other highly confidential information, which if exposed publicly could cause irrevocable damage to the company." Pointsec isn't prepared to name the careless company.

In 2000, Sir Paul McCartney's banking details were discovered on a second-hand computer discarded by merchant bankers Morgan Grenfell Asset Management. The PC was released into the second-user market without first being wiped clean of data.

Pointsec purchased 100 hard disks over auction site as part of its research into the "lifecycle of a lost laptop". It was able to read seven out of 10 hard-drives bought over the Internet at auctions such as eBay ,despite the fact all of had "supposedly" been "wiped-clean" or "re-formatted". T

The company said the exercise illustrates how easy it is for identity thieves or opportunists to access highly sensitive and valuable company information from lost laptops and hard-drives. All the 100 hard drives and laptops purchased as part of Pointsec's research will be destroyed.

Lost in transit

The researchers also wanted to find out how easy it is to purchase and access information on laptops that are lost in transit at an airport Gatwick or handed into the Police. In all cases they found the laptops and all the information residing on them, were put up for auction if they were not reclaimed after three months. Pointsec visited one of the auctions used by Gatwick Airport, near Chertsey, and found that before even purchasing the laptops, the researchers were able to start up the laptops to inspect if they worked. Using password recovery software they accessed the information on one in three of these laptops. The exercise was repeated in Sweden, the US and Germany.

In Sweden the first laptop Pointsec purchased at auction contained sensitive information from a large food manufacturer. The info recovered included four Microsoft Access databases containing company and customer- related information and 15 Microsoft PowerPoint presentations containing highly sensitive company information.

Tony Neate, tactical and technical industry liaison at the UK National Hi-Tech Crime Unit, said: "Pointsec's research demonstrates just how easy it is to access information which is not adequately protected. Encryption and other security measures are vital to ensure that security is not compromised - something as simple as a hard disk drive password can deter the opportunist." ®

Related stories

Paul McCartney account details leaked on second user PC
Datawiping works (true)
Datawiping doesn't work
PDA security slackers, the lot of you
62,000 mobiles lost in London's black cabs

Secure remote control for conventional and virtual desktops

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
prev story

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.