Privacy Commission probes suspected Land Transportation Office (LTO) data leak

guest · Nov 14, 2020

Privacy Commission probes suspected LTO data leak
November 11, 2020
https://cnnphilippines.com/news/2020/11/11/Privacy-Commission-data-leak-probe-car-registrations.html

The National Privacy Commission is investigating a suspected data leak involving car registrations under the Land Transportation Office.

In a statement, the privacy body said it is looking into the data available on lisensya.info, which has a “Motor Vehicle Authenticator” that reveals the car make, plate and engine number, registration expiry date, and the name of the registered owner by encoding the motor vehicle file number. The website also features a “license authenticator” on its homepage.
Click to expand...

The LTO has denied any connection with the website.

However, the NPC said netizens have reported that the vehicle registration data which the site provided were accurate, raising suspicions of a leak from the LTO database.

“The NPC shall verify the incident and look into the extent of possible harm on LTO’s data subjects to determine how to best resolve the situation,” Privacy Commissioner Raymund Liboro said in a statement.
There were 12.725 million vehicles registered with the LTO as of 2019, the regulator said.
Click to expand...

Website in LTO data breach report still accessible

Lisensya.info, a website involved in a data breach that the Land Transportation Office reported to the National Privacy Commission (NPC), still continues to operate pending some procedural protocols.

The LTO Data Protection Officer of the agency filed its initial breach notification report with the NPC Tuesday, November 10, 2020. The NPC also said that a privacy notice is also subject to compliance and does not automatically prompt a stop processing/shutdown.
Last week, the LTO issued a statement assailing lisensya.info for using the LTO logo on its website to establish a false connection with the agency.
Click to expand...

guest · Nov 14, 2020

How hackers collected sensitive data from the Land Transportation Office
November 14, 2020
https://mb.com.ph/2020/11/14/how-ha...ive-data-from-the-land-transportation-office/

The country’s transportation agency is now on a hot seat as thousands of personal information of drivers and vehicle owners were processed and saved by a website pretending to be an official LTO page. Thousands of users were tricked into submitting what looks like harmless information but later used to get their personal data.

Simply put, personally identifiable information under the responsibility of the Land Transportation Office of the Philippines were downloaded by unauthorized individuals.
How the breach happened
API or the Application Programming Interface is a software intermediary that allows two applications to talk to each other. When you use apps like Facebook, order food using Grab Food or check your enrollment details in school, you are using API.

The unauthorized website was able to get additional information based on valid data like license number with a birthday or the 15 digit MV file number because of the misconfiguration in the API of lto.net.ph that holds the complete data of the driver’s license and the vehicle information.
Click to expand...

The website involved in the data breach is “lto.net.ph.”
The transportation agency further denied LTO’s liability and said that a certain Jefferson E. Tronco of Stradcom Corporation registered the domain lto.net.ph

[...] Mr. Dumanhug pointed out that even if the LTO could be correct in saying that the data leak is not from the current web portal the agency is using for its LTMS, still the LTO has the responsibility to secure the data entrusted to them by the users.
Click to expand...

Again, while the LTO is passing the blame to Stradcom, the Data Privacy Act of 2012 says that it’s the responsibility of the information controller to secure personal info even if it was transferred to a third party for processing.
Click to expand...

Log in or Sign up

Privacy Commission probes suspected Land Transportation Office (LTO) data leak

guest Guest

guest Guest

Log in or Sign up

Privacy Commission probes suspected Land Transportation Office (LTO) data leak

guest Guest

guest Guest

Useful Searches