Feeds

Grange Hill firm's website exposed thousands of CVs

H♀lly♂aks in the sh**ty

SANS - Survey on application security programs

Lime Pictures had been mistakenly displaying thousands of individual applicants' personal details on the job section of its website.

We reported yesterday on what initially appeared to be an isolated incident affecting just one applicant.

The Grange Hill and Hollyoaks TV production company had been contacted by a concerned Reg reader last Friday.

However, several readers got in touch with us yesterday to tell us that the problem was far more widespread than first reported.

In fact, up until around mid-afternoon yesterday, the entire database containing the history of nearly 20,000 job applications was open for all to see.

By simply changing the ID number on the query string of the URL, many more personal details of individual applicants were revealed.

It is not known how long the website had been displaying the confidential information which included home addresses, telephone numbers, and salary details. Shortly after The Reg spoke to the TV firm, however, the job section of the site was taken down.

Lime Pictures spokesperson Vicky Owen said the firm's technical team had "assured" her it had been taken down last Friday, immediately after the error was spotted.

She claimed that the job site had been out of action ever since.

"As far as our technical team is concerned as soon as we were alerted to the problem we rectified the situation and until the technology is sorted out no one can make applications via the internet," she said.

Owen insisted that The Reg, and its readers, had got their facts wrong and denied that the personal details were still viewable yesterday.

She added that Lime Pictures takes identity fraud and data protection "very, very, very seriously".

We have passed details of the error on to the Information Commissioner's Office (ICO), the independent body which enforces and oversees the 1998 Data Protection Act. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.