Ministry for Culture and Heritage investigating serious digital privacy breach

guest · Aug 25, 2019

Ministry for Culture and Heritage investigating serious digital privacy breach
August 25, 2019
https://www.newshub.co.nz/home/poli...stigating-serious-digital-privacy-breach.html

Passports, drivers' licences and birth certificate details have been exposed to fraudsters after a serious Government digital privacy breach.
The Ministry for Culture and Heritage says 302 young people supplied their details to it as part of an application for the Tuia 250 Voyage trainee programme.

These were uploaded to an external website which was then compromised, exposing their details.
The issue was identified after a parent of one of the applicants alerted the ministry on Thursday 22 to a fraud attempt using a copy of a driver licence stored on the site.
Click to expand...

guest · Aug 25, 2019

How it came to light: Coding error to blame for data breach
August 25, 2019
https://www.tvnz.co.nz/one-news/new-zealand/came-light-coding-error-blame-data-breach

Ms Cavanagh along with Paul James, Chief Digital Officer fronted media today to answer questions about how it happened.
Ms Cavanagh said a coding error was to blame and consequently the "right protections were not put in place".

"This was just an opportunistic and targeting and finding of information," she said.
Mr James confirmed the website had not been configured correctly.
Ms Cavanagh says the website involved did not have the same security measures as other government websites.
Click to expand...

guest · Sep 20, 2019

Tuia 250 data breach review to probe relationship between Ministry and IT provider
September 20, 2019
https://www.stuff.co.nz/national/po...relationship-between-ministry-and-it-provider

A review into the Ministry of Culture and Heritage will look into a relationship between a staffer and the external developer involved in a massive data breach.

The data breach in August saw passports, birth certificates, and other personal documents for over 300 people compromised, including 71 people under 18-year-olds, thanks to a "data error".

"The Ministry has commissioned an independent review of (inter alia) decisions and processes relating to the procurement and management of the Tuia 250 website. The review will consider the nature and impact of any personal relationships on the breach."
The review is expected to be completed by mid-October.
Click to expand...

guest · Dec 28, 2019

Review of Tuia250 data breach bad end of year for PM
December 28, 2019
https://www.national.org.nz/review_of_tuia250_data_breach_bad_end_of_year_for_pm

The Prime Minister’s year has ended badly with the release of the review of the Tuia250 data breach, National’s Cybersecurity spokesperson Dr Shane Reti says.

“The independent review found three privacy breaches, out of date policies and raised a conflict of interest with staff and the website supplier.
“At that time the previous security settings that allowed information to be downloaded were not changed, and all of the personal information became searchable by web engines and downloadable.

“Jacinda Ardern has been distracted and taken her eyes off her own Ministry, and has allowed 71 young people to have their personal data accessed. That is completely unacceptable, and for the Minister to release this information just before Christmas is deeply cynical.”
Click to expand...

"FInal Report - Independent Review of the Tuia 250 Voyage Trainee Privacy Breach"
(PDF - 878 KB): https://mch.govt.nz/sites/default/files/projects/MCH_Data_Breach_Final_Report_Dec_2019.PDF

guest · Mar 3, 2020

Tuia 250 privacy breach: Tech boss signed off on government website with no testing
March 2, 2020
https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=12313016

A top tech boss at the Ministry of Culture and Heritage (MCH) reviewed the Tuia 250 website's security and declared it "fit for purpose" just two months before a major breach was uncovered, new correspondence shows.

The security lapse - discovered by a member of the public in August 2019 - compromised the privacy of roughly 300 young people who had uploaded sensitive material while applying to take part in commemorations.
Emails show Townsley conducted a "security review" of the site in early June 2019 after concerns were raised within the Ministry.
As part of the assessment, he sought assurances from the contractor, but did not personally test that the site was secure.
Click to expand...

Log in or Sign up

Ministry for Culture and Heritage investigating serious digital privacy breach

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ministry for Culture and Heritage investigating serious digital privacy breach

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches