First State Super breached Privacy Act

Powered by SC Magazine
 

Disclosure crack-down backfires.

Superannuation firm First State Super that issued legal threats against a penetration tester for reporting security holes in its environment has been found in breach of the Privacy Act.

The Office of the Australian Information Commissioner (OAIC) investigated the company after news broke that Sydney-based penetration tester and customer Patrick Webster discovered a direct object reference vulnerability in the fund's website.

The OSI Security consultant had informed IT staff at First State Super about the hole and provided them with a proof of concept bash script which accessed 578 accounts, including members names, addresses, superannuation account details and balances.

First State Super served Webster with legal proceedings (pdf) demanding he hand his computer to the company’s IT staff to ensure data was removed.

Webster, who formerly worked for the NSW Police, went public and the superannuation company later dropped its threats. The company added at the time that it "appreciates" his disclosure and had "no intention of taking any other action against him".

The OAIC found the company in breach of the National Privacy Principles (NPPs) in the Privacy Act because it did not have adequate security measures in place to protect customer information from unauthorised access and disclosure.

“While it is acknowledged that upon becoming aware of the matter, (First State Super) took immediate steps to remedy the situation, this still resulted in a breach of the NPPs”, Privacy Commissioner Timothy Pilgrim said in a statement.

Specifically, Pilgrim found internal audits by parent company Pillar should have detected the flaw even if it were not reported by Webster. This resulted in a breach of NPP 4.1 of the Privacy Act.

The privacy investigation said Pillar ran “over 200 security tests” prior to Webster’s disclosure that did not reveal the direct object reference flaw. The tests were described as “only a sample” of the environment.

Further it said the superannuation company failed to pick up Webster’s bash script in its logs.

As predicted by SC Magazine, the OAIC did not impose penalties against the company because it moved to patch the security holes and immediately informed customers.

Copyright © SC Magazine, Australia


First State Super breached Privacy Act
 
 
 
Top Stories
Slow progress in Turnbullistan
[Blog post] How has the NBN moved ahead since regime change?
 
Hacks and frauds can't dampen Bitcoin buzz
[Blog post] Enthusiasts meet in Melbourne.
 
Qantas checks in with cloud computing
Impressed with results of public cloud bake-off.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  23%
 
Application integration concerns
  3%
 
Security and compliance concerns
  31%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  24%
 
Lack of stakeholder support
  4%
 
Protecting on-premise IT jobs
  4%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 511

Vote