Story image

Vector to take Stuff to High Court; media agency refuses to hand over confidential breach data

04 May 2018

Vector may take legal action against Stuff because the media agency apparently refuses to secure, to return or to destroy confidential data given to them by a hacker.

Last week Vector’s Outage app was breached by an unknown third party, leaking personal information of up to 24,000 customers.

The personal information included customer names, emails, and postal addresses, but no financial information, Vector says.

Stuff informed Vector about the breach and Vector immediately disabled the Outage app. Further reports suggest that Vector was aware of the vulnerability, but did not know it had been breached until it was approached by Stuff.

However Vector says that the hacker provided customers’ confidential data to Stuff. Despite repeated requests, Stuff has ‘repeatedly refused’ to hand it over, destroy it or secure it'.

Stuff editorial director Mark Stevens says that the story was in the public interest. 

"The data was held only until we determined news gathering activities on this story had finished. When I was comfortable with that, I ensured the file containing customer contact details - which we received through a secure server - was destroyed," Stevens says.

Vector says, “Now that the story has been published we believe our customers’ data should be destroyed or returned to Vector. Given Stuff’s repeated refusals to Vector’s requests, Vector now considers it has no choice but to take legal action to ensure its customers’ private information is secured and protected. In our view not doing so would be tantamount to failing our customers again."

“As a result, Vector has applied to the High Court for an injunction to protect the information from further use. We recognise that taking this step is likely to attract further media attention to Vector for the original customer data breach. However, we considered it is more important to take whatever steps we can to secure our customers’ data and protect their privacy.”

However Stuff says that if it handed the data over to Vector, it could lead to identification of the source.

"We not only had the protection of the customer data to consider, but also the protection of our source. Source protection is a basic principle of what we do, and part of the stringent ethical framework we work under," Stevens says.

"When we obtain sensitive information we act responsibly, to protect both our sources and any vulnerable people affected (such as customers here)."

Vector says that a Stuff reporter has also approached at least one Vector customer with unsolicited questions.

Stevens explains: "We have, at all times, treated this information responsibly. Its circulation was limited to staff who needed to see if for news gathering purposes. We have not 'exploited' the information - and we do not sell or otherwise share confidential information we obtain during reporting."

“We fully accept Stuff had a valid right to report on the original data breach. We have made it clear to Stuff that we were not seeking to prevent their reporting on the matter and we have not asked them at any time to disclose their information source. However, we do not believe Stuff should have compounded this matter by exploiting the customer data when reporting on it,” Vector says in a statement.

Vector says it is taking all steps to reduce any additional impact to its customers’ privacy.

“In today’s world, with the recent privacy related revelations about the likes of Facebook and the unauthorised use of personal information by third parties, we believe this is an issue that customers are increasingly aware of and concerned by.”

Vector is working with IDCARE and the Office of the Privacy Commissioner to address its data security.

Read more about the breach here.

Online attackers abusing Kiwis' generosity in wake of Chch tragedy
It doesn’t take some people long to abuse people’s kindness and generosity in a time of mourning.
Apple launches revamped iPad Air & iPad mini
Apple loves tinkering with its existing product lines and coming up with new ways to make things more powerful – and both the iPad Air and iPad mini seem to be no exception.
IntegrationWorks continues expansion with new Brisbane office
The company’s new office space at the Riverside Centre overlooks the Brisbane River and Storey Bridge.
Emerging tech helps savvy SMB’s succeed
A CompTIA report shows SMBs are taking on the challenge of emerging technologies to reach their business goals.
Tech community rocked by deaths of Atta Elayyan and Syed Jahandad Ali
Both men were among the 50 killed in the shooting in Christchurch last Friday when a gunman opened fire at two mosques.
NZ ISPs block internet footage of Christchurch shootings
2degrees, Spark, Vodafone and Vocus are now blocking any website that shows footage of the mosque shootings.
On the road again: How to tackle mileage reporting for business
There may not be too much of a budget for company vehicles in an SMB’s day-to-day business, which means many people are increasingly using their own vehicles for work purposes.
Digital experience managers, get excited for Adobe Summit 2019
“Digital transformation may be a buzzword, but companies are trying to adapt and compete in this changing environment.”