July 26, 2007

Insecure server sees Newcastle council suffer massive data breach

Details of 54,000 residents and millions of transactions are stolen

By Tash Shifrin

---

Newcastle city council has admitted that personal data and payment card details of up to 54,000 local residents has been downloaded from an insecure server to an IP address outside the country.

The stolen data includes names, addresses and card details from transactions between February 2006 and April 2007, mainly for payment of council tax, business rates, parking fines or council housing rent.

The incident is the latest in a string of high-profile data security breaches, many of which have involved laptops.

Other public bodies caught out include Worcestershire council and the NHS.

A security audit carried out for the council by specialists found that the data had been wrongly placed on an insecure server and subsequently downloaded to a computer with an IP address registered in Israel.

Council chief executive Ian Stratford said: "We are now fully confident that our systems are properly robust, so we are continuing to receive payments by credit and debit card.

“We very much regret that this situation has developed, although would again stress that there has been no indication of any fraud or loss, and that we spotted this situation through the thoroughness of our own security and checking systems."

The council said it shut down the servers concerned when it became aware of the problem on Thursday 19 July and has since tightened security. It has informed banks and the Information Commissioner’s Office of the data security breach.

It is understood that card numbers were encrypted, although the council was unable to say immediately whether the other data was also protected by encryption.

An investigation involving the council, banks, the police and security experts is underway, but the council said there was no evidence that the data had been exploited for fraud so far.

Newcastle councillor John Shipley said leading members of the council had been briefed about the incident on Monday 23 July.

"This is an extremely serious breach, which I was shocked to hear about,” he said.

“My first concern is that every possible measure should be put in place now to protect people whose data might have been compromised, and we have communicated this to the banks and credit card companies."

Newsletters

Your daily injection of CW news and expert analysis: we’ll bring the news to you.