A customer database and the current access codes to the supposedly secure Intranet of one of Europe's largest financial services group was left on a hard disk offered for sale on eBay. The disk was subsequently purchased for just £5 by mobile security outfit Pointsec Mobile Technologies.
According to Pointsec, one of the hard disks contained “highly sensitive information from one of Europe's largest financial services groups with pension plans, customer databases, financial information, payroll records, personnel details, login codes, and admin passwords for their secure Intranet site. There were 77 Microsoft Excel documents of customers email addresses, dates of birth, their home addresses, telephone numbers and other highly confidential information, which if exposed publicly could cause irrevocable damage to the company.” Pointsec isn't prepared to name the careless company.
[ … ]
Pointsec purchased 100 hard disks over auction site as part of its research into the “lifecycle of a lost laptop”. It was able to read seven out of 10 hard-drives bought over the Internet at auctions such as eBay ,despite the fact all of had “supposedly” been “wiped-clean” or “re-formatted”.
The company said the exercise illustrates how easy it is for identity thieves or opportunists to access highly sensitive and valuable company information from lost laptops and hard-drives. All the 100 hard drives and laptops purchased as part of Pointsec's research will be destroyed. [Privacy Digest]