UK city council data breach affects 54,000 residents

The Newcastle, U.K., city council has admitted that personal data and payment card details of up to 54,000 local residents has been downloaded from an insecure server to an IP address outside the country.

The stolen data includes names, addresses and card details from transactions between February 2006 and April 2007, mainly for payment of council tax, business rates, parking fines or council housing rent.

The incident is the latest in a string of high-profile data security breaches, many of which have involved laptops.

Other public bodies caught out include Worcestershire council and the NHS.

A security audit carried out for the council by specialists found that the data had been wrongly placed on an insecure server and subsequently downloaded to a computer with an IP address registered in Israel. Council chief executive Ian Stratford said: “We are now fully confident that our systems are properly robust, so we are continuing to receive payments by credit and debit card.

“We very much regret that this situation has developed, although would again stress that there has been no indication of any fraud or loss, and that we spotted this situation through the thoroughness of our own security and checking systems.”

The council said it shut down the servers concerned when it became aware of the problem on Thursday 19 July and has since tightened security. It has informed banks and the Information Commissioner’s Office of the data security breach.

It is understood that card numbers were encrypted, although the council was unable to say immediately whether the other data was also protected by encryption.

An investigation involving the council, banks, the police and security experts is underway, but the council said there was no evidence that the data had been exploited for fraud so far.

Newcastle councillor John Shipley said leading members of the council had been briefed about the incident on July 23. “This is an extremely serious breach, which I was shocked to hear about,” he said.

“My first concern is that every possible measure should be put in place now to protect people whose data might have been compromised, and we have communicated this to the banks and credit card companies.”

Would you recommend this article?

Share

Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.


Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Cybersecurity in 2024: Priorities and challenges for Canadian organizations 

By Derek Manky As predictions for 2024 point to the continued expansion...

Survey shows generative AI is a top priority for Canadian corporate leaders.

Leaders are devoting significant budget to generative AI for 2024 Canadian corporate...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now