Hacked AAPT breached Privacy Act

AAPT breached the Privacy Act after it failed to stop hackers from breaking into its Melbourne IT server in July last year, the Federal Privacy Commissioner has today found.

The watchdog said the kiwi-owned telco also failed to destroy personal information for former customers.

The telco's breach of the Act meant it was forced to run vulnerability assessments on all applications, audit its IT security frameworks and implement regular staff training in relation to data retention and destruction.

Pilgrim could not enforce financial penalties since he commenced the investigation in August of his own initiative.

AAPT was breached after personal information of current and former customers was published online by hackers from the Anonymous collective.

The hackers told SC at the time that they broke into the server by exploiting a "very old" flaw in its deployment of Adobe ColdFusion.

The failure was a significant but simplistic security lapse for AAPT making the breach a trivial one.

The assailants nabbed a year-old backup of AAPT's business website and published customer names, addresses and phone numbers on the Pastebin website.

Some of the affected records included details from Federal Government agencies.

Commissioner Timothy Pilgrim said not enough was done to protect customers.

"More should have been done to appropriately manage and protect the information involved," Pilgrim said in a statement.

"Using older versions of applications and software when newer versions are available is a risk that needs to be actively managed, particularly when personal information is involved."

The hacked server held data used to verify and obtain credit reports on AAPT business customers, churn them from other carriers and to provide sales information to staff.

Incoming reforms to Australia's privacy laws set for enforcement from March next year will grant the Commissioner power to seek the imposition of fines on breached organisations through the courts.

He said organisations should ensure IT contracts clearly stated where responsibility lay for IT security.

Copyright © SC Magazine, Australia