Where is Your Data? This is the old site

In May 2008 HSBC “lost” a server, an entire server, from the Kwun Tong office in Hong Kong. There are 159,000 customer records on the server. HSBC insisted that the chances of the data being misused were small as there were numerous “security” arrangements to prevent access, however all of these security controls are based on somebody trying to log on to the server. If somebody wants to access the data directly from the disks, normally the security becomes completely redundant.

This incident follows on from the an incident in June 2006 when HSBC  staff from an Indian call center stole data and used it to commit fraud. Later In 2008 HSBC lost CDs with 37,000 customer details on. In 2005 180,000 HSBC customers credit card details were exposed, and some of their accounts accessed.

Article

In January 2008 the Ministry of Defence admitted that a laptop had been stolen.

The laptop, which like so many other cases of data loss was not encrypted, contained the personal records of over 600,000 defence staff.

Following an investigation into this data loss the MoD found that two other laptops had been stolen, neither of which were encrypted. As a result the head of the Civil Service has told Whitehall staff not to remove laptops with sensitive data from their offices. If there is no need to remove laptops from the office, and they contain sensative information, why is the data even on laptops? Why are these staff issues laptops that are not supposed to be taken out of the building? why not issue the staff with desktops which are secured to the desk/floor, in a secure MoD building? Even better, why is encryption not used as standard?

This data loss followed on from numerous other instances of data loss, including the NHS data loss and the now infamous case of the HMRC losing data (the HMRC data loss, which was subsequently slated in numerous reports). All of these data breaches were avoidable by basic common sense, despite this the MoD theft of a laptop still occurred and the government have still not learnt their lesson and there have been two more cases of data loss, due to a lack of encryption. The first is the loss of a “terror file“, the second is the loss of another laptop.

In June 2008 a report into the MoD Laptop theft by Sir Edmund found that the loss was due to variety of issues, but mainly failures within the MoD. The report blamed the “”rapid and often uninhibited exchange of information”, and the fact that the MoD has lost its “cold war” mentality towards security. The full MoD Report by Sir Edmund Burton is avaible for download.

Articles:

ZDNet

BBC

In January 2008 it was reported that the Ministry of Justice lost 4 CDs containing court records, witness and case details, and a variety of other sensitive information.

Like many other cases this was data, that was unencrypted, and sent in the post.

Article

In April 2008 HSBC reported it has lost data on it that contain the records of 37,000 customers. In this case the records did not contain financial information, rather information relating to insurance, e.g does a person smoke or not. The data was password protected, but not actually encrypted, which means that the data could have been accessed relatively easily.

The fact that HSBC has policies that allow the use of an ineffective security program is staggering. Why would HSBC invest in a CD security tool that does not actually encrypt? Surely the costs would be a few pence more to get an encryption tool that actually works? No critical data was lost on this occasion, but it appears to be more luck than judgment.

This problem is compounded by the fact it is not the first HSBC has had data issues. In 2006 HSBC had staff at their Indian call center access client details to steal data, and in May 2008 they lost an entire server. In 2005 180,000 HSBC customers credit card details were exposed, and some of their accounts accessed.

Full Article