Personal data from Experian on 40% of South Africa's population has been bundled onto a file-sharing website
- Reference: 1600102813
- News link: https://www.theregister.co.uk/2020/09/14/south_africa_experian_data_breach_wesendit/
- Source link:
Despite [1]assurances from Experian in August that it had obtained an Anton Piller court order - a type of search warrant in legal proceedings - to seize and destroy the data it haplessly passed on, 40 per cent of South Africa's population is now living in the knowledge that any random bod browsing Swiss file-sharing site WeSendIt could have freely downloaded their personal data.
The country has a population of around 56 million people.
Mobile phone numbers, state-issued personal ID numbers, home addresses, banking and work details and email addresses were all included in the file on WeSendIt, [2]according to South Africa's Sunday Times .
Experian says it recovered and deleted data on 24 million South Africans after giving it to random 'marketing' person [3]READ MORE
The file on WeSendIt contained the details of 24 million people and 800,000 businesses, the same number as we [4]reported at the time of the original breach .
"The breach involves the cross-border flow of personal information. This is unacceptable. Millions of citizens' and businesses' personal information is on the internet with no proper control over it," raged Pansy Tlakula, South Africa's Information Regulator (SAIR), a local equivalent of Britain's information commissioner.
Back in August Experian said: "We can confirm that no consumer credit or consumer financial information was obtained," while admitting: "The fraudster provided Experian with 25,055,049 names, surnames and South African identity numbers which Experian verified. The data shared was limited to contact information including telephone, email and physical address and employment information which includes place of work, title, start date and work contact details."
We have asked Experian to comment on this latest development.
The news comes weeks after the not-quite-stolen data was found to be circulating on the dark web, on souk or souks unknown. A whistleblower told SAIR at the start of September that that file included people's "cell numbers, home and work phone numbers, employment details and identity numbers," to the evident fury of the data regulator.
"The Regulator is extremely disturbed about the information that it has received from the whistleblower, particularly because during the meeting which it held with Experian last week, its Chief Executive Officer, Mr Ferdie Pieterse assured the Regulator that Experian had obtained an Anton Piller order and managed to execute the order in terms of which the personal information of data subjects was appropriately secured," thundered the SAIR in a [5]press statement [PDF].
An Anton Piller order is a civil law search warrant named for a 1975 English case to do with trade secret theft: Anton Piller KG v Manufacturing Processes Limited .
While data breaches traditionally consist of data being stolen, Experian's apparent willingness to hand millions of people's data to one person shows that breaches can come about through lack of due diligence as well as the obvious security-related routes we all know and love. ®
Get our [6]Tech Resources
[1] https://www.theregister.com/2020/08/20/experian_24m_south_africans_data_breach/
[2] https://www.timeslive.co.za/sunday-times/news/2020-09-13-data-from-huge-experian-breach-found-on-the-internet/
[3] https://www.theregister.com/2020/08/20/experian_24m_south_africans_data_breach/
[4] https://www.theregister.com/2020/08/20/experian_24m_south_africans_data_breach/
[5] https://justice.gov.za/inforeg/docs/ms-20200903-ExperianUpdate.pdf
[6] https://whitepapers.theregister.com/
Cynically
Just wait, they'll claim it is a back up:
https://www.theregister.com/2020/09/14/who_me/
Are you Experianced?
> Despite assurances from Experian in August that it had obtained an Anton Piller court order
That must have come as a complete shock: a proven liar who who previously lied to Experian also lied to the Court about agreeing to abide by the order.
What's that saying? Fool me once...
The $64,000 question
One has to ask whether it's reasonable and proportionate for any one company to collect all this information without any choice on the part of the data subject. Just for example, in what way are "employment information which includes place of work, title, start date and work contact details" relevant to current credit rating, reporting on which which is the only even notionally legitimate function of a credit reference agency ?
Re: The $64,000 question
Speaking as a former employee of Experian. They do a lot more than just credit references. They collate a vast amount of data on everyone and everything and use it for lots of things.
1. Marketing purposes e.g. if company X wants to send out junk mail, who are the people who are more likely to respond positively to it? A crude example would be not to send out mailings about the latest top of the range Mercedes to people living on a council estate; while you might get some positive hits, you will get more bang for your advertising buck by mailing to those with certain jobs, residential areas, life aspirations and incomes.
2. Where to build stuff? A huge amount of analysis goes into where to build things like a McDonalds. The number of people who would walk there at lunch time, office workers, school kids, shoppers etc based on analysis of the number of each type of potential customer and their distance from the proposed store, taking into account competition for other burger chains. If there is to be a drive in, detailed analysis of the traffic flows around the area and how likely people would be to use it.
Experian have their fingers into every data source available. I was shocked at the colossal amount of data they have on every individual and household in the country. We all have our own unique ID number. When collated it is a goldmine for businesses of many types. They have everything from electoral registers to data on who have bought what new car from what dealership to how many kids (and ages) are in the household, what schools they are likely to attend etc. They were also looking at collating data on shopping via loyalty cards, so they would also know what you buy, where and when - not sure if that one ever got off the ground as the amount of data involved was pushing the limits at the time.
Have you ever come across area profiles on the net? Experian is the powerhouse behind the data. e.g. you put in a post code and you get a breakdown of the crime rate in that area, the house prices, average household incomes and various other data.
I could go on, but you get the basic idea.
Re: The $64,000 question
Haven't you ever had a credit check? Those are all the sorts of questions they ask you when applying for credit.
Didn't they fire that one guy whom they said was solely responsible for the previous breach?
Thought that was going to ensure it would never happen again...