16 June 2011

Data Loss, yet again

This week's data loss (I confess that loss is now so routine that I'm losing track, despite an article in this month's Privacy Law Bulletin regarding the Sony imbroglio) involves the Australian Institute of Company Directors (AICD).

Reports in the SMH suggest that loss of a desktop computer followed a scheduled power outage that "temporarily disabled the office's security systems, including swipe card access to its entrance".

What walked out the door? The AICD apparently doesn't know or is being caregful about what information's released to the media (as distinct from the computer thieves). The SMH indicates that "the personal details of tens of thousands of Australia's most important business figures may have been compromised after the brazen theft of a computer from the offices of thein Sydney."

AICD chief executive John Colvin reportedly said the device may have contained "names, residential addresses, phone numbers, dates of birth and email addresses of its 27,000 members, which include the directors of some of the country's largest listed companies, government bodies and charities".

Those lucky people presumably should not lose sleep, with a spokesperson indicating that the theft appeared opportunistic and did not appear to be a co-ordinated attempt at identity theft -
All the evidence suggests it was an opportunistic theft; we have nothing to suggest it was targeted
All ok, then.

The AICD's media release states that -
“The data on the computer was protected. We understand that the risk of its being accessed and used for fraudulent purposes is low and that its utility is minimal, as much of the information is publicly available,” Company Directors’ CEO, Mr John Colvin, said.

“We felt it was important, however, to let our members and clients know what had happened.”

“We have alerted our members and clients that the computer contained test data which may possibly include names, addresses, phone numbers, date of birth and, in some cases, the names of personal assistants and their email addresses where they have been provided.”

“The stolen computer did not contain data about credit card numbers, banking details, personal email addresses of members and clients or passwords.”

“While we are of the view that the risk is low, we take this matter and the privacy of our members very seriously,” Mr Colvin said.

“With the police and forensic experts, we are investigating the theft and reviewing our security. We have also consulted the Privacy Commissioner and are following his best practice guidelines in dealing with this.”

“This loss of data was the result of criminal activity involving the theft of computer hardware. We have assured our members and clients that we have strong data security precautions in place and that our data storage and other systems, including our website, are not compromised in any way.”