Feeds

Telstra shutters customer self-service site after security blunder

Passwords? We’ve heard of them

Intelligent flash storage arrays

Several sharp-eyed readers have pointed El Register to the latest corporate security howler in Australia: Telstra’s customer self-service site has had to be shut down after it sprayed sensitive customer data to the world at large.

First reported on the Australian broadband discussion site Whirlpool (original post here) and then picked up by the Sydney Morning Herald and then The Australian, the potentially-massive breach allowed an Internet user to bypass the front-page security of the BigPond self-help site and access details of other users.

The exposed site offered customer service-level access to customers of Telstra bundled products. Information accessible included a veritable feast for identity theft: bundle information, telephone numbers, users’ names and addresses, and according to the Whirlpool discussion, users’ login and password information.

The Register cannot verify the extent of the breach, because once it became aware of the issue, Telstra barred access to the site (incidentally interrupting BigPond users’ access to Webmail).

The site is not actually hosted on a Telstra domain: it’s a cloud-based service on the custhelp.com domain operated by RightNow Technologies, which is currently in the throes of being acquired by Oracle. The Register has sought comment on the incident and is awaiting a response.

As The Australian notes, the serious privacy breach could affect a very large number of customers, with more than 650,000 new bundle customers sold last year. Australia’s Privacy Commissioner is investigating.

Telstra has stated that it will contact customers, but at the time of writing, this process did not seem to have begun. ®

Update: A reader has advised The Register that Telstra's BigPond POP and SMTP servers are currently offline. Although not on the affected RightNow servers, since customer logins may have been compromised, Telstra has probably taken services down as a precaution.

The carrier's status page states that "some online services remain unavailable as a precaution".

A Telstra spokesperson has stated on Twtter that as many as 60,000 customers "will need password resets to reduce risk from privacy breach" (sic). This suggests the carrier has assessed the logs of its customer self-service portal and has an estimate of how many accounts may have been compromised. ®

Top 5 reasons to deploy VMware with Tegile

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.