First State Super breached Privacy Act

By Darren Pauli on Jun 8, 2012 8:27 AM
Filed under Security

Disclosure crack-down backfires.

Superannuation firm First State Super has been found in breach of the Privacy Act after threatening legal action against a penetration tester for reporting security holes in its environment 

The Office of the Australian Information Commissioner (OAIC) investigated the company after news broke that Sydney-based penetration tester and customer Patrick Webster discovered a direct object reference vulnerability in the fund's website.

The OSI Security consultant had informed IT staff at First State Super about the hole and provided them with a proof of concept bash script which accessed 578 accounts, including members names, addresses, superannuation account details and balances.

First State Super served Webster with legal proceedings (pdf) demanding he hand his computer to the company’s IT staff to ensure data was removed.

Webster, who formerly worked for the NSW Police, went public and the superannuation company later dropped its threats. The company added at the time that it "appreciates" his disclosure and had "no intention of taking any other action against him".

The OAIC found the company in breach of the National Privacy Principles (NPPs) in the Privacy Act because it did not have adequate security measures in place to protect customer information from unauthorised access and disclosure.

“While it is acknowledged that upon becoming aware of the matter, (First State Super) took immediate steps to remedy the situation, this still resulted in a breach of the NPPs”, Privacy Commissioner Timothy Pilgrim said in a statement.

Specifically, Pilgrim found internal audits by parent company Pillar should have detected the flaw even if it were not reported by Webster. This resulted in a breach of NPP 4.1 of the Privacy Act.

The privacy investigation said Pillar ran “over 200 security tests” prior to Webster’s disclosure that did not reveal the direct object reference flaw. The tests were described as “only a sample” of the environment.

Further it said the superannuation company failed to pick up Webster’s bash script in its logs.

As predicted by SC Magazine, the OAIC did not impose penalties against the company because it moved to patch the security holes and immediately informed customers.

 
Follow us on Facebook and Twitter
 

Copyright © SC Magazine, Australia

First State Super breached Privacy Act
 
 
 
 
 
Top Stories
Microsoft Surface revenue hits $1 billion in a quarter
While iPad sales fall, Surface sees massive turnaround.
 
Australia's top 10 recent channel movers
Who was hired, promoted and who defected?
 
 
Sign up to receive CRN email bulletins
   FOLLOW US...
Polls
Is Microsoft right to limit the reseller channel for Surface?

Latest Comments
CRN Magazine

Issue: 331 | September 2014

CRN Magazine looks in-depth at the emerging issues and developments for the channel, and provides insight, analysis and strategic information to help resellers better run their businesses.