Feeds

Missile data, medical records found on discarded hard disks

Study finds all manner of stuff on eBay

Security for virtualized datacentres

A third (34 per cent) of discarded hard disk drives still contain confidential data, according to a new study which unearthed copies of hospital records and sensitive military information on eBayed kit.

The study, sponsored by BT and Sims Lifecycle Services and run by the computer science labs at University of Glamorgan in Wales, Edith Cowan University in Australia and Longwood University in the US, also found network data and security logs from the German Embassy in Paris on one purchased drive.

Researchers bought 300 drives from eBay, other auction sites, second-hand stalls and car boot sales.

A disk bought on eBay contained details of test launch routines for the THAAD (Terminal High Altitude Area Defence) ground to air missile defence system. The same disk also held information belonging to the system’s manufacturer, Lockheed Martin, including blueprints of facilities and personal data on workers, including social security numbers.

Lockheed Martin denies that the disk came from it. The arm manufacturer has launched an investigation that aims to uncover just how the sensitive data might have been wound up on the disk.

Two discs bought in the UK apparently came from Lanarkshire NHS Trust, including patient medical records, images of X-rays and staff letters. Lanarkshire NHS Trust runs the Monklands and Hairmyres hospitals.

In Australia, the exercise turned up a disk from a nursing home that contained pictures of actual patients and their wound photos, along with patient details.

A hard disk from a US bank contained account numbers and details of plans for a $50bn currency exchange through Spain. Details of business transactions between the bank and organisations in Venezuela, Tunisia and Nigeria were also included.

Correspondence between a member of the Federal Reserve Board and the unnamed banks revealed that one of the deals was already under scrutiny by the European Central Bank, and that federal investigators were also taking an interest.

Yet another disk contained business plans about a well known UK-based fashion company. The same disk contained customer details and discount codes. Finally still yet another disk contained corporate design plans from a major motor manufacturing company. You get the idea.

The University of Glamorgan has now been running the survey for five years, in which time the volume of drives containing sensitive data has fallen from a half to little over a third. But the actual volume of data potentially exposed has increased markedly, alongside the potential sensitivity of that data.

"If military secrets are thrown away then anything can be," Jon Godfrey of Sims Recycling Solutions, which provide secure data destruction services, told El Reg. "Organisations spend millions on data security products such as firewalls to protect data but fail to think about discarded data.

"Residual data can still be accessed years after the equipment has been discarded and in the wrong hands could have not only financial consequences but potential implications for national security. It is essential that organisations destroy data via a professional and secure data destruction system or through physical destruction, before passing the equipment for secondary use."

The data destruction problem extends beyond computer hard disks to a growing diversity of devices, such as mobile phones, MP3 players, SatNavs, printers and even set top boxes. Each can hold a "snapshot of our lives" containing data that is finding its way to China, Africa and Eastern Europe. For example, second-hand BlackBerries containing data are on sale for a premium in Nigerian street markets. ®

Remote control for virtualized desktops

More from The Register

next story
UK smart meters arrive in 2020. Hackers have ALREADY found a flaw
Energy summit bods warned of free energy bonanza
DRUPAL-OPCALYPSE! Devs say best assume your CMS is owned
SQLi hole was hit hard, fast, and before most admins knew it needed patching
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Mozilla releases geolocating WiFi sniffer for Android
As if the civilians who never change access point passwords will ever opt out of this one
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Reducing the cost and complexity of web vulnerability management
How using vulnerability assessments to identify exploitable weaknesses and take corrective action can reduce the risk of hackers finding your site and attacking it.