3 ms·

I've discovered a data breach, what should I do?

I've just discovered a data breach - 80,000+ names, emails, addresses and birthdates all publicly available on Google. This is personally identifiable information. The data owner is not responding. What should I do?

Khao 15y ago
Trying to contact Google could be a good thing. They would probably remove it from their system so at least it's not searchable from Google and make it harder to find.
- bermudatriangle 15y ago
  Thanks for the idea but this falls outside Google's criteria for reporting personal info in search results: http://www.google.com/support/webmasters/bin/answer.py?answer=164133 http://www.google.com/support/webmasters/bin/answer.py?answe... Basically they say 'tell the site owner to remove it...'
jnorthrop 15y ago
Send them a list of data breach notification laws by state: http://www.csoonline.com/article/439940/state-breach-disclosure-laws-update http://www.csoonline.com/article/439940/state-breach-disclos... That might scare them into action. They have very real legal obligations and if they are in Europe the laws are even more strict. Edit: A more complete list: http://www.ncsl.org/IssuesResearch/TelecommunicationsInformationTechnology/SecurityBreachNotificationLaws/tabid/13489/Default.aspx http://www.ncsl.org/IssuesResearch/TelecommunicationsInforma...
- bermudatriangle 15y ago
  I might give that a try! They are an international company but the problem is on one of their UK sites so I'll look into the European equivalent. They've left an Excel file containing their mailing database sitting in an unprotected folder on their public website. You can download it direct from Google's search results. My own details are in that file which is how I found them and obviously why I want it taken down asap.
- bermudatriangle 15y ago
  Well, I'll leave it a few more days to give them a 'reasonable' period to sort it out, then put in a complaint to the UK's ICO office: http://www.ico.gov.uk/complaints/data_protection.aspx http://www.ico.gov.uk/complaints/data_protection.aspx Although I'm pissed they neither responded to my complaint nor bothered to remove the spreadsheet. Makes me wonder how ignorant some of these corporations really are...
deleted 15y ago
[deleted]

Khao 15y ago

Trying to contact Google could be a good thing. They would probably remove it from their system so at least it's not searchable from Google and make it harder to find.

bermudatriangle 15y ago
Thanks for the idea but this falls outside Google's criteria for reporting personal info in search results: http://www.google.com/support/webmasters/bin/answer.py?answer=164133 http://www.google.com/support/webmasters/bin/answer.py?answe... Basically they say 'tell the site owner to remove it...'

jnorthrop 15y ago

Send them a list of data breach notification laws by state: http://www.csoonline.com/article/439940/state-breach-disclosure-laws-update http://www.csoonline.com/article/439940/state-breach-disclos... That might scare them into action. They have very real legal obligations and if they are in Europe the laws are even more strict. Edit: A more complete list: http://www.ncsl.org/IssuesResearch/TelecommunicationsInformationTechnology/SecurityBreachNotificationLaws/tabid/13489/Default.aspx http://www.ncsl.org/IssuesResearch/TelecommunicationsInforma...

bermudatriangle 15y ago
I might give that a try! They are an international company but the problem is on one of their UK sites so I'll look into the European equivalent. They've left an Excel file containing their mailing database sitting in an unprotected folder on their public website. You can download it direct from Google's search results. My own details are in that file which is how I found them and obviously why I want it taken down asap.
bermudatriangle 15y ago
Well, I'll leave it a few more days to give them a 'reasonable' period to sort it out, then put in a complaint to the UK's ICO office: http://www.ico.gov.uk/complaints/data_protection.aspx http://www.ico.gov.uk/complaints/data_protection.aspx Although I'm pissed they neither responded to my complaint nor bothered to remove the spreadsheet. Makes me wonder how ignorant some of these corporations really are...

deleted 15y ago

[deleted]