Feeds

Toshiba in Rugby World Cup personal data compo cockup

Muddied oafs fail to defend open ID goal

The essential guide to IT transformation

Toshiba has made something of a ruck-up in a Rugby World Cup competition, exposing customer details in the process.

UK consumers purchasing new Toshiba laptops were offered a £1 rebate for every point England's Toby Flood scores in the tournament, which kicks off next weekend. Customers were invited to apply by submitting their personal details to a website, receiving a link to a certificate of registration in return.

The suggested URLs came in the form:

toshibaregistrations.com/rugbyworldcup/Certificates/TOSH1500.pdf.

Henry Dillon, on receiving this certificate, realised certificates containing personal information had been uploaded to an open webserver with no attempt made to obfuscate the URL.

Sure enough Henry was able to see the personal details (name, home address, date of birth, telephone number, model and serial number of laptop bought) of other users by changing the number in the final part of the URL from TOSH1500.pdf to TOSH1501.PDF or other values. Toshiba plugged the security snafu in late August, which Dillon estimates might have affected 1,800 competition entrants.

Dillon, who waited until Toshiba had pulled the plug on the offending PDFs, has a write-up of the problem (containing an obfuscated grab of one of the offending PDFs) in a blog post here.

Dillon told El Reg that he had not reported the matter to data privacy watchdogs at the ICO.

Toshiba acknowledged the problem, for which it apologised, and promised to get in touch with affected customers. ®

Next gen security for virtualised datacentres

More from The Register

next story
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Linux kernel devs made to finger their dongles before contributing code
Two-factor auth enabled for Kernel.org repositories
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.