Salmat coder blamed for St.George data leak

Mar 4, 2010 1:40 PM
Tags: stgeorge | bank | outsource | salmat | protocol | privacy

42,000 account details compromised.

A "statement production issue" has caused the account information of 42,000 St.George Bank account holders to be sent to other customers.

The error was blamed on an interruption in the data processing function at ASX-listed business process outsourcing firm Salmat on 26 February.

According to Salmat COO Peter Anson, the error occurred when a programmer "went against protocol" and intervened after a file was found to be corrupted.

"Normally, data comes in and it runs on an automated process," Anson explained. "In this particular run, the file was corrupted. Corruption took place during our processing; I believe it was a software glitch."

"When it went to print, we knew there was an error. The programmer went against protocol and manually intervened."

Anson said that disciplinary action would be taken. The company was "deeply embarrassed", and had publicly apologised to St.George Bank and its customers, he said.

According to a St.George spokesperson, only personal savings accounts were affected.

Some of the statements would erroneously display no transactions or account balance for the month ending 26 February. Others displayed the transaction history of other customers.

Approximately 1,300 statements also featured the account number of other customers, presenting privacy issues and an opportunity for fraud.

The St.George spokesperson told iTnews that those 1,300 accounts would be closely monitored by fraud detection teams so any irregularities would be identified.

St.George also established a dedicated, 24/7 telephone line, 1300 668 460, with additional staff to assist customers affected by erroneous statements.

"We can guarantee that customers will not suffer any financial losses resulting from this issue," he said.

He added that it was a serious issue, but would not comment on how it would affect St.George's relationship with Salmat.

"The error is unacceptable to us; we're looking at the process and investigating the issue further," he said.

In December 2003, Salmat beat 17 of St.George's Group Procurement key suppliers to win the bank's inaugural "Supplier Of The Year" award for printing and distributing customer statements and shareholder communications.

The banking sector was a core market for the company, Anson said, although its other banking clients could not be named.

Salmat also provided customer relationship management services to the Australian Taxation Office (ATO), Coles Myer and Woolworths. Neither reported having had any issues with its services.


  • Email a Friend
  • Print Page
Salmat coder blamed for St.George data leak
"The protocol probably wasn't known or happenned to be an instruction sent along with the other hundreds of messages sent down by managers. Anyway, the fact that programmers need access to ..."
By Spock
 
 
Comments: 5
Thoughts on this article? Add a comment below.
DavidJordan
Mar 4, 2010 2:41 PM
This is serious as it could have caused a run on the bank and is an issue of reputational risk under Basel II, the international banking regulation. Financial Institutions are taking risks for profits by low cost outsourcing which being cheap comes at a sacrifice, that sacrifice is usually quality and integrity. APRA needs to be taking a long hard look at the banks outsourcing to India and other low cost organisations as the potential risk of something more serious occuring is quite high.
myoung
Mar 5, 2010 8:01 AM
Salmat is not an Indian Outsourcer. It's an Australian company founded in 1979 by Philip SALter and Peter MATtick. St George Bank outsourced the work to some Aussie workers.
M_Princz
Mar 5, 2010 2:02 PM
Personally I have a huge problem with this. How can you blame a developer? they write the code ok but surely that code needs to be tested, or even before testing reviewed by a peer. Even once it is tested, the final approval for the change to a major client like St. George needs to come from a manager or client executive.

This is yet another incident of poor Application Lifecycle Management from a supposedly top tier Australian company. "The developer" is a quaint scapegoat for poor process and policy.

Salmat you are not alone in these practices, however, by not understanding risk, impact and traceability your mistakes have becoming public knowledge.
Yertle
Mar 5, 2010 3:41 PM
it sounds like he messed with an input file which is probably outside the change control process. i don't think he is being blamed for the glitch that caused the corruption but for going against their protocols.

I would imagine finance company's would take breaking the procedures and protocols pretty seriously (i've never worked in finance)
Spock
Mar 5, 2010 7:17 PM
The protocol probably wasn't known or happenned to be an instruction sent along with the other hundreds of messages sent down by managers. Anyway, the fact that programmers need access to production systems shows that the protocols are not mature enough.
Comment:
Want to participate in the discussion?
Or log in now to comment
 
 
 
Top Stories
Oracle shuts down open source test servers
Playing nice with the open source community, Larry?
 
Google hosts election debate
Lundy, Fletcher and Ludlam face off on tech policies.
 
Telstra fined $18.5m for exchange access
Kept competitive DSLAM kit out.
 

Latest VideosSee all videos »

Latest Comments
"Now Julia, if only you would promise not to filter the internet in your next term of government ..."
by hsvandrew Jul 31, 2010 9:33 AM
 
"@Nate - my fears are that if we use a national consortium as an interface to international ..."
by heavenlyhaloes Jul 31, 2010 12:41 AM
 
"Did anybody notice that on Apple's website the iPhone is missing the AT&T logo on the top bar? ..."
by brownenicola Jul 30, 2010 10:18 PM
 
"@digger11 - when will you learn just to remain quiet when you don't have all the facts or a ..."
by Bazwalt Jul 30, 2010 7:13 PM
 
"Wakie is right, Digger11 is either an exceptional forum troll or a massive moron. For those who ..."
by Bazwalt Jul 30, 2010 6:51 PM
Polls
Did Google breach the Telecommunications Interception or Privacy Acts during its WiFi wardrive?

   |   View results
Yes. There is no excuse for collecting this data.
  28%
 
No. If your wireless network is unsecured, you have no right to complain
  72%
TOTAL VOTES: 1873

Vote