Story image

Vector to take Stuff to High Court; media agency refuses to hand over confidential breach data

04 May 2018

Vector may take legal action against Stuff because the media agency apparently refuses to secure, to return or to destroy confidential data given to them by a hacker.

Last week Vector’s Outage app was breached by an unknown third party, leaking personal information of up to 24,000 customers.

The personal information included customer names, emails, and postal addresses, but no financial information, Vector says.

Stuff informed Vector about the breach and Vector immediately disabled the Outage app. Further reports suggest that Vector was aware of the vulnerability, but did not know it had been breached until it was approached by Stuff.

However Vector says that the hacker provided customers’ confidential data to Stuff. Despite repeated requests, Stuff has ‘repeatedly refused’ to hand it over, destroy it or secure it'.

Stuff editorial director Mark Stevens says that the story was in the public interest. 

"The data was held only until we determined news gathering activities on this story had finished. When I was comfortable with that, I ensured the file containing customer contact details - which we received through a secure server - was destroyed," Stevens says.

Vector says, “Now that the story has been published we believe our customers’ data should be destroyed or returned to Vector. Given Stuff’s repeated refusals to Vector’s requests, Vector now considers it has no choice but to take legal action to ensure its customers’ private information is secured and protected. In our view not doing so would be tantamount to failing our customers again."

“As a result, Vector has applied to the High Court for an injunction to protect the information from further use. We recognise that taking this step is likely to attract further media attention to Vector for the original customer data breach. However, we considered it is more important to take whatever steps we can to secure our customers’ data and protect their privacy.”

However Stuff says that if it handed the data over to Vector, it could lead to identification of the source.

"We not only had the protection of the customer data to consider, but also the protection of our source. Source protection is a basic principle of what we do, and part of the stringent ethical framework we work under," Stevens says.

"When we obtain sensitive information we act responsibly, to protect both our sources and any vulnerable people affected (such as customers here)."

Vector says that a Stuff reporter has also approached at least one Vector customer with unsolicited questions.

Stevens explains: "We have, at all times, treated this information responsibly. Its circulation was limited to staff who needed to see if for news gathering purposes. We have not 'exploited' the information - and we do not sell or otherwise share confidential information we obtain during reporting."

“We fully accept Stuff had a valid right to report on the original data breach. We have made it clear to Stuff that we were not seeking to prevent their reporting on the matter and we have not asked them at any time to disclose their information source. However, we do not believe Stuff should have compounded this matter by exploiting the customer data when reporting on it,” Vector says in a statement.

Vector says it is taking all steps to reduce any additional impact to its customers’ privacy.

“In today’s world, with the recent privacy related revelations about the likes of Facebook and the unauthorised use of personal information by third parties, we believe this is an issue that customers are increasingly aware of and concerned by.”

Vector is working with IDCARE and the Office of the Privacy Commissioner to address its data security.

Read more about the breach here.

SecOps: Clear opportunities for powerful collaboration
If there’s one thing security and IT ops professionals should do this year, the words ‘team up’ should be top priority.
Interview: Culture and cloud - the battle for cybersecurity
ESET CTO Juraj Malcho talks about the importance of culture in a cybersecurity strategy and the challenges and benefits of a world in the cloud.
Enterprise cloud deployments being exploited by cybercriminals
A new report has revealed a concerning number of enterprises still believe security is the responsibility of the cloud service provider.
Ping Identity Platform updated with new CX and IT automation
The new versions improve the user and administrative experience, while also aiming to meet enterprise needs to operate quickly and purposefully.
Venafi and nCipher Security partner on machine identity protection
Cryptographic keys serve as machine identities and are the foundation of enterprise information technology systems.
Machine learning is a tool and the bad guys are using it
KPMG NZ’s CIO and ESET’s CTO spoke at a recent cybersecurity conference about how machine learning and data analytics are not to be feared, but used.
Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.