Story image

Vector's Outage app hit by data breach last month - personal info stolen

04 May 2018

Vector was hit by a data breach last month, which exposed names, phone numbers, emails, and data that could lead to the locations of customers who reported an outage.

The breach happened on April 26, 2018. According to Vector, the attacker leaked details to media organisation Stuff. Stuff has refused to destroy, return or secure the data that was stolen.

On April 27 the company posted a FAQ section that detailed an API vulnerability in its Outage app.

The vulnerability was exploited by an unknown third party, who then hacked the app. The attacker may have gained access to personal information about app users and anyone who had used the app to report an outage.

While personal information may have been compromised, no financial information such as bank account or credit card details were stolen.

Vector says the breach was confined to information provided by customers to the app. The company’s electricity network, financial systems and website were not compromised.

“This data breach comes as we are working to significantly improve our customers’ information experience during an outage, which was a clear problem following a recent storm,” Vector says in a statement.

According to the company’s FAQ, ‘a number of app customers may have been affected by this data breach’. All customers should now be notified either by email or by letter. The email will be sent from privacy@vector.co.nz.

“We have taken the immediate step of disabling the Vector Outage app and withdrawn all customer records which were breached,” the company says.

Customers who want to report or find out about outages must call Vector directly or visit Vector’s website for more information.

“We are working hard to redesign and relaunch our outage app based on customer feedback and performance during the recent storm to create an industry leading customer experience,” Vector says.
 
“We will also be ensuring that our customer data is stored, maintained and managed securely in line with best practice and world standards.”

Vector suggests that customers:

  • Consider your security for online accounts where you’ve used your email address for account identification.
  • Be aware that following this breach, your email address may potentially be the subject of heightened spam activity, and in all cases we recommend you take care when opening emails and/or clicking on links.
  • Note that Vector will never request passwords or financial information from you over email.
  • For more information on how to ensure your information remains safe and how to recognise potential online scams, visit www.netsafe.org.nz

“We ask our customers to be extra vigilant if they receive any unsolicited communication from anyone purporting to be from Vector.”

Machine learning is a tool and the bad guys are using it
KPMG NZ’s CIO and ESET’s CTO spoke at a recent cybersecurity conference about how machine learning and data analytics are not to be feared, but used.
Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.
How blockchain could help stop video piracy in its tracks
An Australian video tech firm has successfully tested a blockchain trial that could end up being a welcome relief for video creators and the fight against video piracy.
IBM X-Force Red & Qualys introduce automated patching
IBM X-Force Red and Qualys are declaring a war on unpatched systems, and they believe automation is the answer.
Micro Focus acquires Interset to improve predictive analytics
Interset utilises user and entity behavioural analytics (UEBA) and machine learning to give security professionals what they need to execute threat detection analysis.
Raising the stakes: McAfee’s predictions for cybersecurity
Security teams and solutions will have to contend with synergistic threats, increasingly backed by artificial intelligence to avoid detection.
Exclusive: Ping Identity on security risk mitigation
“Effective security controls are measured and defined by the direct mitigation of inherent and residual risk.”