AAPT breaches privacy rules over server hack

AAPT will escape financial penalties after being found in breach of the Privacy Act for failing to stop hackers from breaking into an externally-hosted server in July last year.

The federal Privacy Commissoner said AAPT had been forced to run vulnerability assessments on all applications, audit its IT security frameworks and implement regular staff training in relation to data retention and destruction.

However, Commissioner Timothy Pilgrim could not enforce financial penalties because he instigated the investigation.

AAPT was breached after personal information of current and former customers was published online by hackers from the Anonymous collective.

The hackers told SC at the time that they broke into the server by exploiting a "very old" flaw in its deployment of Adobe ColdFusion.

The failure was a significant but simplistic security lapse for AAPT. The assailants nabbed a year-old backup of AAPT's business website and published customer names, addresses and phone numbers on the Pastebin website.

Some of the affected records included details from Federal Government agencies.

The hacked server held data used to verify and obtain credit reports on AAPT business customers, churn them from other carriers and to provide sales information to staff.

Pilgrim said not enough was done to protect customers. "More should have been done to appropriately manage and protect the information involved," Pilgrim said in a statement.

"Using older versions of applications and software when newer versions are available is a risk that needs to be actively managed, particularly when personal information is involved."

Reforms to Australia's privacy laws set for enforcement from March next year will grant the Commissioner power to seek the imposition of fines on breached organisations through the courts.

He said organisations should ensure IT contracts clearly stated where responsibility lay for IT security.

Copyright © SC Magazine, Australia