First State Super breached Privacy Act

By on
First State Super breached Privacy Act

Disclosure crack-down backfires.

Superannuation firm First State Super that issued legal threats against a penetration tester for reporting security holes in its environment has been found in breach of the Privacy Act.

The Office of the Australian Information Commissioner (OAIC) investigated the company after news broke that Sydney-based penetration tester and customer Patrick Webster discovered a direct object reference vulnerability in the fund's website.

The OSI Security consultant had informed IT staff at First State Super about the hole and provided them with a proof of concept bash script which accessed 578 accounts, including members names, addresses, superannuation account details and balances.

First State Super served Webster with legal proceedings (pdf) demanding he hand his computer to the company’s IT staff to ensure data was removed.

Webster, who formerly worked for the NSW Police, went public and the superannuation company later dropped its threats. The company added at the time that it "appreciates" his disclosure and had "no intention of taking any other action against him".

The OAIC found the company in breach of the National Privacy Principles (NPPs) in the Privacy Act because it did not have adequate security measures in place to protect customer information from unauthorised access and disclosure.

“While it is acknowledged that upon becoming aware of the matter, (First State Super) took immediate steps to remedy the situation, this still resulted in a breach of the NPPs”, Privacy Commissioner Timothy Pilgrim said in a statement.

Specifically, Pilgrim found internal audits by parent company Pillar should have detected the flaw even if it were not reported by Webster. This resulted in a breach of NPP 4.1 of the Privacy Act.

The privacy investigation said Pillar ran “over 200 security tests” prior to Webster’s disclosure that did not reveal the direct object reference flaw. The tests were described as “only a sample” of the environment.

Further it said the superannuation company failed to pick up Webster’s bash script in its logs.

As predicted by SC Magazine, the OAIC did not impose penalties against the company because it moved to patch the security holes and immediately informed customers.

Copyright © SC Magazine, Australia

Tags:

Most Read Articles

You must be a registered member of iTnews to post a comment.
| Register

Poll

New Windows 10 users, are you upgrading from...
Windows 8
Windows 7
Windows XP
Another operating system
Windows Vista
How should the costs of Australia's piracy scheme be split?
Rights holders should foot the whole bill
50/50
ISPs should foot the whole bill
Government should chip in a bit
Other
View poll archive

Whitepapers from our sponsors

What will the stadium of the future look like?
What will the stadium of the future look like?
New technology adoption is pushing enterprise networks to breaking point
New technology adoption is pushing enterprise networks to breaking point
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
The next era of business continuity: Are you ready for an always-on world?
The next era of business continuity: Are you ready for an always-on world?

Log In

Username:
Password:
|  Forgot your password?