| Quote from: Fletch |
Firstly, we would like to apologise again to customers affected by the leak of data from ACS Law. We can confirm that we did send unencrypted data to ACS Law. However, this was not the cause of the leak. At a later date, due to a cyber-attack on the systems of the law firm, data that it held was leaked.
|
Wrong. You sent the data unencrypted, therefore you have no idea whatever as to whether it was intercepted in transit. It probably wasn't, but if your approach to security is "nah mate, no-one's going to syphon off data in transit" you're in the wrong line of work. Perhaps read Bruce Schneier's book on email security, maybe he'll cut you a discount since he works for the same organisation.
For the nth time; the attack did NOT leak the data; the incompetence of the system administrator in rebuilding the website made the email archive accessible to any passer by. You can try and point the waggy finger at "wrong 'uns", but as with much of this sorry tale, it was incompetence and improper protection of sensitive information that exposed the customer data; the attack merely allowed the sysadmin to showcase his world class incompetence on a national stage.
That stupidity, does not however excuse BTs own.
| Quote from: Fletch |
We are extremely angry with ACS Law for allowing this to happen.
|
And some of us here are extremely angry at BT for passing the details on unencrypted via insecure email, documented damage or no.
| Quote from: Fletch |
As a result of the incident at ACS Law, Plusnet will be providing all affected customers with an Identity Protection Service, including internet security software, free of charge for the next 12 months. We will contact customers directly regarding this over the coming days.
|
Will you also be contacting customers who may have had details handed over in previous fishing expeditions by law firms, but who were never contacted, and are thus unaware that their details may be floating around unsecured?
| Quote from: Fletch |
We are investigating how we came to be sending unencrypted data as we have robust systems for managing data. We have already ensured that this type of incident will not happen again, launched an internal enquiry and we have alerted the Information Commissioner's Office (ICO). We will work with the ICO to clarify our position.
|
Ah, yes damage limitation. the virtually worthless ICO gets to look tough and PN gets to play the grateful company back on the right track. Meanwhile we wait for the other shoe to drop.
| Quote from: Fletch |
...we will resist efforts to share more customer details with them and those acting on their behalf until we can be sure that alleged copyright infringements have some basis and customers are treated fairly.
|
You could have avoided a great deal of distress, ill feeling and bad PR if you had taken something resembling a principled approach to start with, and made "robust" mean something with regard to user data.
