NSW driver’s licences, tolling data publicly accessible on Amazon server

Krusty · Sep 1, 2020

The NSW government has blamed a “commercial business” for the accidental leaking of licences that were kept on a publicly accessible erver. (sic)

The departments for transport and cyber security in Australia’s biggest state are investigating how tens of thousands of people had images of their driver’s licence leaked online, and have so far blamed a private company for the breach.

A cache of more than 108,000 images showing the front and backs of NSW driver’s licences was freely available on an Amazon cloud server according to the Ukrainian security consultant that stumbled upon them, Bob Diachenko.

He told the ABC the licences and tolling notices that were on the server represented a “dangerous exposure”
Click to expand...

https://www.news.com.au/technology/...r/news-story/1d66c4862c160a9a7c9f068dfe8ed16e

Krusty · Sep 1, 2020

Data breach exposes tens of thousands of NSW driver’s licences online

[...]
Leading cyber expert and founder of data breach tool Have I Been Pwned, Troy Hunt, said this was an unusual and uncommon kind of breach and it might be too little, too late.

Mr Hunt said even if Transport NSW was not culpable, it had a responsibility to disclose the potentially "high risk" leak to protect its customers.

"I think there should have been a notice," Mr Hunt said.

"I would be pushing for a disclosure on this, because it's something that's quite important."

Even if the licence details, such as the card number, weren't used directly there was "powerful information" on there and it was enough to commit identity theft.

One example he provided would be using it for "social engineering", such as creating a fake Facebook account to solicit relatives for money.

He was concerned about the toll notices having emails and passwords, which are almost always compromised eventually because regular users have poor security hygiene.

Once a malicious actor had a person's email and password, he said, their "ability to go on and do damage is massive".
Click to expand...

https://www.abc.net.au/news/2020-09-01/nsw-drivers-licence-data-breach-under-investigation/12611918

Krusty · Sep 2, 2020

Amazon won't disclose identity of company linked to driver's licence data breach, NSW Government says

Amazon is refusing to disclose the identity of the owner of the open cloud storage where 54,000 NSW driver's licences were found, the NSW Government says.

Last week, about 108,535 documents were discovered by a security consultant in Ukraine on an accessible server hosted by Amazon.

Inside the cache were front and back scans of tens of thousands of NSW driver's licences which included full names, addresses and dates of birth.

The NSW Government has been blasted for failing to notify NSW drivers that their personal details have been exposed.

However, Service NSW says it has been forced to work with third-party organisations to identify the owner of the Amazon Web Service (AWS) 'bucket' which hosted the documents.

"AWS currently won't disclose the name of the entity, but have confirmed it is a commercial entity," a Cyber Security NSW spokesperson said.

Cyber Security NSW, which is currently investigating the breach, said it had been trying to make the commercial entity aware "of its responsibilities to report and remediate any breach".

"We do not know how long this commercial entity had this data open for," said Cyber Security NSW chief security officer Tony Chapman.

"We do not know whether anybody other than the security researcher quoted in media coverage has accessed the information."
Click to expand...

https://www.abc.net.au/news/2020-09...-not-disclosing-owner-of-data-breach/12620632

Log in or Sign up

NSW driver’s licences, tolling data publicly accessible on Amazon server

Krusty Registered Member

Krusty Registered Member

Krusty Registered Member

Log in or Sign up

NSW driver’s licences, tolling data publicly accessible on Amazon server

Krusty Registered Member

Krusty Registered Member

Krusty Registered Member

Useful Searches