Story image

Vector to take Stuff to High Court; media agency refuses to hand over confidential breach data

04 May 18

Vector may take legal action against Stuff because the media agency apparently refuses to secure, to return or to destroy confidential data given to them by a hacker.

Last week Vector’s Outage app was breached by an unknown third party, leaking personal information of up to 24,000 customers.

The personal information included customer names, emails, and postal addresses, but no financial information, Vector says.

Stuff informed Vector about the breach and Vector immediately disabled the Outage app. Further reports suggest that Vector was aware of the vulnerability, but did not know it had been breached until it was approached by Stuff.

However Vector says that the hacker provided customers’ confidential data to Stuff. Despite repeated requests, Stuff has ‘repeatedly refused’ to hand it over, destroy it or secure it'.

Stuff editorial director Mark Stevens says that the story was in the public interest. 

"The data was held only until we determined news gathering activities on this story had finished. When I was comfortable with that, I ensured the file containing customer contact details - which we received through a secure server - was destroyed," Stevens says.

Vector says, “Now that the story has been published we believe our customers’ data should be destroyed or returned to Vector. Given Stuff’s repeated refusals to Vector’s requests, Vector now considers it has no choice but to take legal action to ensure its customers’ private information is secured and protected. In our view not doing so would be tantamount to failing our customers again."

“As a result, Vector has applied to the High Court for an injunction to protect the information from further use. We recognise that taking this step is likely to attract further media attention to Vector for the original customer data breach. However, we considered it is more important to take whatever steps we can to secure our customers’ data and protect their privacy.”

However Stuff says that if it handed the data over to Vector, it could lead to identification of the source.

"We not only had the protection of the customer data to consider, but also the protection of our source. Source protection is a basic principle of what we do, and part of the stringent ethical framework we work under," Stevens says.

"When we obtain sensitive information we act responsibly, to protect both our sources and any vulnerable people affected (such as customers here)."

Vector says that a Stuff reporter has also approached at least one Vector customer with unsolicited questions.

Stevens explains: "We have, at all times, treated this information responsibly. Its circulation was limited to staff who needed to see if for news gathering purposes. We have not 'exploited' the information - and we do not sell or otherwise share confidential information we obtain during reporting."

“We fully accept Stuff had a valid right to report on the original data breach. We have made it clear to Stuff that we were not seeking to prevent their reporting on the matter and we have not asked them at any time to disclose their information source. However, we do not believe Stuff should have compounded this matter by exploiting the customer data when reporting on it,” Vector says in a statement.

Vector says it is taking all steps to reduce any additional impact to its customers’ privacy.

“In today’s world, with the recent privacy related revelations about the likes of Facebook and the unauthorised use of personal information by third parties, we believe this is an issue that customers are increasingly aware of and concerned by.”

Vector is working with IDCARE and the Office of the Privacy Commissioner to address its data security.

Read more about the breach here.

Wine firm uses AR to tell its story right on the bottle
A Central Otago wine company is using augmented reality (AR) and a ‘digital first’ strategy to change the way it builds its brand and engages with customers.
DigiCert conquers Google's distrust of Symantec certs
“This could have been an extremely disruptive event to online commerce," comments DigiCert CEO John Merrill. 
Protecting organisations against internal fraud
Most companies tend to take a basic approach that focuses on numbers and compliance, without much room for grey areas or negotiation.
Telesmart to deliver Cloud Calling for Microsoft Teams
The integration will allow Telesmart’s Cloud Calling for Microsoft Teams to natively enable external voice connectivity from within Teams collaborative workflow environment.
Jade Software & Ambit take chatbots to next level of AI
“Conversation Agents present a huge opportunity to increase customer and employee engagement in a cost-effective manner."
52mil users affected by Google+’s second data breach
Google+ APIs will be shut down within the next 90 days, and the consumer platform will be disabled in April 2019 instead of August 2019 as originally planned.
GirlBoss wins 2018 YES Emerging Alumni of the Year Award
The people have spoken – GirlBoss CEO and founder Alexia Hilbertidou has been crowned this year’s Young Enterprise Scheme (YES) Emerging Alumni of the Year.
SingleSource scores R&D grant to explore digital identity over blockchain
Callaghan Innovation has awarded a $318,000 R&D grant to Auckland-based firm SingleSource, a company that applies risk scoring to digital identity.