Ng reveals massive MSD privacy breach
This is a must read story. Keith Ng details how you can access pretty much the entire MSD computer system through their public kiosks. We are talking sensitive details magnitudes worse than in the ACC privacy breach. We’re talking:
- fraud investigations
- invoices including all contractors (including their media trainers who will now be much needed)
- details of candidates for adoptions
- children in CYFS care
- medical records
- Debts owed to MSD
- Full names of kids in their High and Complex Needs section
- Names of kids in CYFS residential care
- Phone bills that reveal physical addresses of CYFS homes
- Bills from pharmacies that deatils which children get which medications
- An invoices from a community group for whanau support after a suicide, with the full name of the deceased
Keith says:
- Public kiosks should not have been connected to the corporate network.
- Servers that didn’t need to be globally accessible should not have been globally accessible, even if they only contained innocuous data.
- Invoices, file logs and call logs, at a place like MSD, should not have been treated as innocuous data.
That is a minimum. I’d expect invoices to be username and password accessible only. But the first point is the key one – the kiosks should not be linked to the corporate network.
It goes beyond saying that there must be a full inquiry into this. I have to say that my expectationis there should be staff resignations over this. This is not like ACC where the privacy breach was a mistake – a file accidentally attached to an e-mail. Mistakes will always happen. This appears to be a case of fundamentally flawed decisions – such as connecting the kiosks to the corporate network.
I don’t know how long it has been this way, but it must change.
Keith is a freelance journalist. If you want to help fund the excellent work he has done in this area, you can donate to it here. I have.
Talking on insecure data, you should also read how Whale managed to change the advertisements on The Standard through an insecure adserver. Also not a good look.