Several sharp-eyed readers have pointed El Register to the latest corporate security howler in Australia: Telstra’s customer self-service site has had to be shut down after it sprayed sensitive customer data to the world at large.
First reported on the Australian broadband discussion site Whirlpool (original post here) and then picked up by the Sydney Morning Herald and then The Australian, the potentially-massive breach allowed an Internet user to bypass the front-page security of the BigPond self-help site and access details of other users.
The exposed site offered customer service-level access to customers of Telstra bundled products. Information accessible included a veritable feast for identity theft: bundle information, telephone numbers, users’ names and addresses, and according to the Whirlpool discussion, users’ login and password information.
The Register cannot verify the extent of the breach, because once it became aware of the issue, Telstra barred access to the site (incidentally interrupting BigPond users’ access to Webmail).
The site is not actually hosted on a Telstra domain: it’s a cloud-based service on the custhelp.com domain operated by RightNow Technologies, which is currently in the throes of being acquired by Oracle. The Register has sought comment on the incident and is awaiting a response.
As The Australian notes, the serious privacy breach could affect a very large number of customers, with more than 650,000 new bundle customers sold last year. Australia’s Privacy Commissioner is investigating.
Telstra has stated that it will contact customers, but at the time of writing, this process did not seem to have begun. ®
Update: A reader has advised The Register that Telstra's BigPond POP and SMTP servers are currently offline. Although not on the affected RightNow servers, since customer logins may have been compromised, Telstra has probably taken services down as a precaution.
The carrier's status page states that "some online services remain unavailable as a precaution".
A Telstra spokesperson has stated on Twtter that as many as 60,000 customers "will need password resets to reduce risk from privacy breach" (sic). This suggests the carrier has assessed the logs of its customer self-service portal and has an estimate of how many accounts may have been compromised. ®