he preliminary assessment revealed that the phishers had stolen legitimate user names and passwords from employers who used the agency's website and that the phishers had fraudulently accessed jobseeker information.
The IT team brought the problem to the attention of senior management and quickly contained the breach by disabling the compromised employer accounts. Based on the IT team's assessment, senior staff moved to evaluate risks associated with the breach and considered what actions should be taken to mitigate any potential harm.
The recruitment agency then upgraded the security on its website to prevent future breaches of employer and jobseeker information. To prevent a similar breach, it also informed employers that used its services that it had put in place stricter log-in protocols.
A popular Australian online gaming service sold access to its gaming network on a subscription basis. It collected and held a range of personal information from its customers in order to create a user account and deal with subscription payments. Details included names, dates of birth, email addresses, postal addresses, and credit card numbers.
During a routine security check, the gaming service discovered through the use of intrusion detection software that the server containing its account information had been compromised, and the account information of over 500,000 customers had been hacked and, most likely, copied.
The gaming service took immediate steps to contain the breach (including temporarily shutting down its servers) and notified the Australian privacy authority. Based on its belief that criminal activity had been involved, it also contacted Police.
Police then investigated, during which time they asked the company not to release any information about the breach. The company also engaged a technology security firm to enhance the security of its accounts systems.
When Police were satisfied it would not compromise their investigation, the company notified the affected customers. It explained exactly what happened and when, that Police were investigating and the privacy authority had been notified. It also suggested that affected customers monitor their credit card accounts and contact their financial institution if they had any concerns.
Insights from agencies
“Carry out regular audits on your agency’s IT security. Employ an IT security company to conduct penetration tests on your system to look for security flaws. Fix any weaknesses that are identified.”
“Have a notice counting the days since the last data breach and celebrate as an agency when the time elapsed breaks a previous record.”
Finding other people’s information
People sometimes have information sent to them that's not theirs, or they may find other people's information in places like cafes or on public transport. If this happens to you, you should treat the information like the valuable lost property it is. You have legal obligations once you are in possession of information that identifies other people, or that is clearly confidential.
Privacy breach guidelines
The Office of the Privacy Commissioner’s voluntary privacy breach guidelines provide the key steps for agencies to respond to privacy breaches.
How to contact the Office of the Privacy Commissioner
Write to us:
PO Box 10-094
The Terrace, Wellington 6143.
Fax: (04) 474 7595
Enquiries Line (for general enquiries):
0800 803 909 (from 8.30am to 5pm, Monday to Friday)
04-474 7590 (Wellington)
09-302 8680 (Auckland)
Media Enquiries (for media use only):
021 509 735
View the pdf of the Data Safety Toolkit.