First State Super breached Privacy Act

By Darren Pauli on Jun 8, 2012 8:27 AM
Filed under Security

Disclosure crack-down backfires.

Superannuation firm First State Super has been found in breach of the Privacy Act after threatening legal action against a penetration tester for reporting security holes in its environment 

The Office of the Australian Information Commissioner (OAIC) investigated the company after news broke that Sydney-based penetration tester and customer Patrick Webster discovered a direct object reference vulnerability in the fund's website.

The OSI Security consultant had informed IT staff at First State Super about the hole and provided them with a proof of concept bash script which accessed 578 accounts, including members names, addresses, superannuation account details and balances.

First State Super served Webster with legal proceedings (pdf) demanding he hand his computer to the company’s IT staff to ensure data was removed.

Webster, who formerly worked for the NSW Police, went public and the superannuation company later dropped its threats. The company added at the time that it "appreciates" his disclosure and had "no intention of taking any other action against him".

The OAIC found the company in breach of the National Privacy Principles (NPPs) in the Privacy Act because it did not have adequate security measures in place to protect customer information from unauthorised access and disclosure.

“While it is acknowledged that upon becoming aware of the matter, (First State Super) took immediate steps to remedy the situation, this still resulted in a breach of the NPPs”, Privacy Commissioner Timothy Pilgrim said in a statement.

Specifically, Pilgrim found internal audits by parent company Pillar should have detected the flaw even if it were not reported by Webster. This resulted in a breach of NPP 4.1 of the Privacy Act.

The privacy investigation said Pillar ran “over 200 security tests” prior to Webster’s disclosure that did not reveal the direct object reference flaw. The tests were described as “only a sample” of the environment.

Further it said the superannuation company failed to pick up Webster’s bash script in its logs.

As predicted by SC Magazine, the OAIC did not impose penalties against the company because it moved to patch the security holes and immediately informed customers.

 
Follow us on Facebook and Twitter
 

Copyright © SC Magazine, Australia

First State Super breached Privacy Act
 
 
 
 
 
Top Stories
Here's what the Dicker Data mega-merger means in dollars
Distie to report $200 million jump in revenue.
 
Office 365 hiring coup for Brisbane gold partner
Million-mailbox Microsoft migration expert goes channel.
 
 
Sign up to receive CRN email bulletins
   FOLLOW US...
Polls
Which mobile device couldn't you live without?


Latest Comments
CRN Magazine

Issue: 328 | June 2014

CRN Magazine looks in-depth at the emerging issues and developments for the channel, and provides insight, analysis and strategic information to help resellers better run their businesses.