AAPT warned over Melbourne IT breach

Australia's communications regulator has formally warned AAPT over a July 2012 data breach that saw some of the telco’s small business customers’ personal information compromised.

The Australian Communications and Media Authority (ACMA)  today said AAPT had contravened the Telecommunications Consumer Protections Code (TCP Code) when hacker group Anonymous accessed one of its servers last year.

At the time, Anonymous claimed to have stolen 40GB of data in protest of the Federal Government’s draft data retention policies.

The data was hosted by AAPT service provider Melbourne IT, and accessed through a well-known Adobe Cold Fusion vulnerability.

ACMA’s investigation, which commenced on 24 September last year, found that Anonymous had stolen 601 tables from a back-up database containing 264,691 customer names, 1394 drivers licence numbers and 13 sets of credit card details.

AAPT had intended to decommission the server but failed to do so “due to an oversight resulting from the departure of key staff and a lack of transparency of applicable processes and policies”.

“AAPT did not adopt its own policy on the retention and disposal of data,” ACMA stated.

“The retention of relevant customer personal information on a server after it was no longer required, and the failure to treat it in accordance with its own policy, in the view of the ACMA, meant that the information was not adequately protected by AAPT.”

AAPT sent 1393 notification letters to customers whose sensitive information had been breached, and liaised with the Australian Federal Police to mitigate potential harm.

Noting that AAPT had taken steps to improve its processes and staff awareness of its policies since the incident, ACMA said a formal warning was “appropriate in the circumstances”.

AAPT chief executive officer David Yuile said the company was committed to the security and privacy of its customers and took the matter very seriously.

"We will continue to regularly review our processes and procedures to ensure compliance with the [TCP] Code," he said.