Feeds

Missile data, medical records found on discarded hard disks

Study finds all manner of stuff on eBay

Top 5 reasons to deploy VMware with Tegile

A third (34 per cent) of discarded hard disk drives still contain confidential data, according to a new study which unearthed copies of hospital records and sensitive military information on eBayed kit.

The study, sponsored by BT and Sims Lifecycle Services and run by the computer science labs at University of Glamorgan in Wales, Edith Cowan University in Australia and Longwood University in the US, also found network data and security logs from the German Embassy in Paris on one purchased drive.

Researchers bought 300 drives from eBay, other auction sites, second-hand stalls and car boot sales.

A disk bought on eBay contained details of test launch routines for the THAAD (Terminal High Altitude Area Defence) ground to air missile defence system. The same disk also held information belonging to the system’s manufacturer, Lockheed Martin, including blueprints of facilities and personal data on workers, including social security numbers.

Lockheed Martin denies that the disk came from it. The arm manufacturer has launched an investigation that aims to uncover just how the sensitive data might have been wound up on the disk.

Two discs bought in the UK apparently came from Lanarkshire NHS Trust, including patient medical records, images of X-rays and staff letters. Lanarkshire NHS Trust runs the Monklands and Hairmyres hospitals.

In Australia, the exercise turned up a disk from a nursing home that contained pictures of actual patients and their wound photos, along with patient details.

A hard disk from a US bank contained account numbers and details of plans for a $50bn currency exchange through Spain. Details of business transactions between the bank and organisations in Venezuela, Tunisia and Nigeria were also included.

Correspondence between a member of the Federal Reserve Board and the unnamed banks revealed that one of the deals was already under scrutiny by the European Central Bank, and that federal investigators were also taking an interest.

Yet another disk contained business plans about a well known UK-based fashion company. The same disk contained customer details and discount codes. Finally still yet another disk contained corporate design plans from a major motor manufacturing company. You get the idea.

The University of Glamorgan has now been running the survey for five years, in which time the volume of drives containing sensitive data has fallen from a half to little over a third. But the actual volume of data potentially exposed has increased markedly, alongside the potential sensitivity of that data.

"If military secrets are thrown away then anything can be," Jon Godfrey of Sims Recycling Solutions, which provide secure data destruction services, told El Reg. "Organisations spend millions on data security products such as firewalls to protect data but fail to think about discarded data.

"Residual data can still be accessed years after the equipment has been discarded and in the wrong hands could have not only financial consequences but potential implications for national security. It is essential that organisations destroy data via a professional and secure data destruction system or through physical destruction, before passing the equipment for secondary use."

The data destruction problem extends beyond computer hard disks to a growing diversity of devices, such as mobile phones, MP3 players, SatNavs, printers and even set top boxes. Each can hold a "snapshot of our lives" containing data that is finding its way to China, Africa and Eastern Europe. For example, second-hand BlackBerries containing data are on sale for a premium in Nigerian street markets. ®

Security for virtualized datacentres

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Home Depot ignored staff warnings of security fail laundry list
'Just use cash', former security staffer warns friends
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.