Customers' Bank details sold on Ebay!!

A Mail Source spokeswoman said the incident was an "honest mistake".She added: "The computer was removed from our secure storage facility in Essex and sold on eBay.

How honest can you get?

Nothing should leave the building without being thoroughly wiped, in fact I would go so far as to say that hard disk drives and non-volatile memory should be physically destroyed. This just makes a mockery of financial responsibility.

LongTermLurker wrote: »

How honest can you get?

Nothing should leave the building without being thoroughly wiped, in fact I would go so far as to say that hard disk drives and non-volatile memory should be physically destroyed. This just makes a mockery of financial responsibility.

Agreed - it is ludicrous that a company handling highly sensitive financial data would sell used hard disks on ebay AT ALL. It's amazing what can be recovered from hard disks, even if the previous owners think they have been erased.

When I spoke to my manager at the company I used to work at about taking some of their obsolete computer equipment I was told "fine - but leave the hard disks". The data on those hard disks would have been of no interest to anyone except possibly a couple of competing companies.

Surely data of that sensitivity should also have been encrypted as an extra security measure.

I can only assume that the people in charge of Graphic Data either have very limited IT knowledge or have no control over what individual employees get up to with company equipment. Either way it's pretty scary.

Just to make it clear - it isn't a bank that's managed to FUBAR, it's a data company.

I didn't say it was a bank who'd lost the data - the data company has responsibility for the financial data and it is ludicrous that banks aren't taking the responsibility of ensuring that their suppliers adhere to sound practices and procedures. It's even more luicrous that the data company doesn't follow suitable procedures. Anyone with even the lowest knowledge of computer systems knows that data is recoverable unless either encrypted or overwritten up to 30 times. If the data company knew that the disk contained financial data, then in my mind they have been irresponsible in allowing that data out of their control - intentional or not. At the very least they have allowed a person with too little knowledge access to the server.

The only way to ensure data privacy is to physically make the disk and non-volatile memory unusable (I'm not talking RAM - that loses its contents when powered off; FLASH memory or battery-backed RAM doesn't).

Originally Posted by benjus
Agreed - it is ludicrous that a company handling highly sensitive financial data would sell used hard disks on ebay AT ALL.

It would not appear to have been 'deliberate,'

It doesn't have to be deliberate. My guess is that someone was told to "get all those old computers on ebay" and someone picked up the server - it's not unknown.

However, whatever the reason, the company is grossly negligent in not enforcing proper procedures; it's no different to a governemt minister leaving a laptop on a train.

I fail to see why they are flapping over a PC/Dumb terminal as banks use UNIX/VMS mainframes or SQL/ORACLE database servers for data storage, unless it was a server with a full database on it I doubt very much any data will be retrieved from it.