4 ms·

The biggest problem is how data is stored and used - it seems it got common place to have just one for all the customer dealings, rather than a number that can

The biggest problem is how data is stored and used - it seems it got common place to have just one for all the customer dealings, rather than a number that can synch easily - but to combat data loss, keeping small database facing the web or other attack points exposing a limited amount of information removes much of the reward a lucky hacker might gain. For most uses of online and customers, it shouldn't need date of birth and their driver's licence number, just the necessities, like customer number and secure access ... maybe a hashed credit card number to confirm. Anything more than that generally requires people to contact support ... why then have a singular database that with the right exploit ... oops sorry about that.

guidedlight 4y ago
My understanding is that attack was through a third party that had access to Latitude’s network for legitimate business purposes. Counter terrorism legislation requires than financial services companies store customer identification. The issue was not adequately restricting the third party communications into Latitude’s network.
- EdwardDiego 4y ago
  My PII was compromised. I've never had a Gem Visa card, but I have had hire purchases 10 - 15 years ago with Harvey Norman, who some time ago shifted from in-house credit to using Latitude, and obviously uploaded their entire customer DB. > Counter terrorism legislation requires than financial services companies store customer identification. I was very much not their customer. The third party was https://dxc.com https://dxc.com
- anenefan 4y ago
  If there's a chink in the security, it's just a matter of time ... as such, there's a question that's not really being asked, does x or any third party need all the details. Sometimes they do because which ever company had found a cheap service to do all the account processing or some other task. But more often I don't think third parties don't need full access to the master database via web access ... if they do then surely the customer needs to be informed who the company's partner is, and what that company's policy is to guarding any personal data loss/ misuse / retention. From what I see lately (and there has been some massive data loss here in Australia in just the last year) there's a very care free lax attitude with a few shrugs after data is lost - with the hope naughty hackers can be blamed.
jacquesm 4y ago
Data is stored in many places in your average company. First of all in the main databases, then possibly on staging servers and in some cases even on test servers (where it probably really shouldn't be except in some very special circumstances). There are third party services that the company may have purchased where some or even all of the data is stored ((sub-)processors or in some cases co-controllers), or which have been given access. Hosting providers, database service providers, search tools etc. Then there are the backups, often unencrypted even today, and often accessible to too many people and not nearly secured as well as they should be.
- anenefan 4y ago
  Yes, the more data a company has directly facing the web or exploitable path with third parties, the greater the risk. Enough risk, having a private network beings to look cost effective.
  - jacquesm 4y ago
    Don't discount the insider walks off with the data risk.
    - hgsgm 4y ago
      There are a small number of insiders generally easy to track, and millions of outside attackers.
      - jacquesm 4y ago
        > generally easy to track In principle. But in practice this is quite hard, especially in smaller organizations, or in large organizations that have a relatively small tech department. And that's before you get into companies that use outsourcing. Some stats show the majority of all breaches have an insider component, either wittingly or unwittingly.

guidedlight 4y ago

My understanding is that attack was through a third party that had access to Latitude’s network for legitimate business purposes. Counter terrorism legislation requires than financial services companies store customer identification. The issue was not adequately restricting the third party communications into Latitude’s network.

EdwardDiego 4y ago
My PII was compromised. I've never had a Gem Visa card, but I have had hire purchases 10 - 15 years ago with Harvey Norman, who some time ago shifted from in-house credit to using Latitude, and obviously uploaded their entire customer DB. > Counter terrorism legislation requires than financial services companies store customer identification. I was very much not their customer. The third party was https://dxc.com https://dxc.com
anenefan 4y ago
If there's a chink in the security, it's just a matter of time ... as such, there's a question that's not really being asked, does x or any third party need all the details. Sometimes they do because which ever company had found a cheap service to do all the account processing or some other task. But more often I don't think third parties don't need full access to the master database via web access ... if they do then surely the customer needs to be informed who the company's partner is, and what that company's policy is to guarding any personal data loss/ misuse / retention. From what I see lately (and there has been some massive data loss here in Australia in just the last year) there's a very care free lax attitude with a few shrugs after data is lost - with the hope naughty hackers can be blamed.

jacquesm 4y ago

Data is stored in many places in your average company. First of all in the main databases, then possibly on staging servers and in some cases even on test servers (where it probably really shouldn't be except in some very special circumstances). There are third party services that the company may have purchased where some or even all of the data is stored ((sub-)processors or in some cases co-controllers), or which have been given access. Hosting providers, database service providers, search tools etc. Then there are the backups, often unencrypted even today, and often accessible to too many people and not nearly secured as well as they should be.

anenefan 4y ago
Yes, the more data a company has directly facing the web or exploitable path with third parties, the greater the risk. Enough risk, having a private network beings to look cost effective.
- jacquesm 4y ago
  Don't discount the insider walks off with the data risk.
  - hgsgm 4y ago
    There are a small number of insiders generally easy to track, and millions of outside attackers.
    - jacquesm 4y ago
      > generally easy to track In principle. But in practice this is quite hard, especially in smaller organizations, or in large organizations that have a relatively small tech department. And that's before you get into companies that use outsourcing. Some stats show the majority of all breaches have an insider component, either wittingly or unwittingly.