What should we do when your data is leaked online?

[Vicari0]

Firstly I expect MybroadBabd to validate the leak to air sure it's legit.. After which given thy have consent from the organisation to then disclose the leak . All this is dependent on on the sensitivity of information leaked. Naturally highly sensitive information that could impact the customer financially should be disclosed as soon as possible so that both the organisation in question and the client can put in mitigating controls.

 

[ChocolateBadger]

Publish immediately. It's not mybbs duty to show favor. Companies need to be punished for not implementing systems capable of handling sensitive data. Hacks happen but storage of sensitive data has been tried and tested

 

[profeet]

Publish immediately. It's not mybbs duty to show favor. Companies need to be punished for not implementing systems capable of handling sensitive data. Hacks happen but storage of sensitive data has been tried and tested

If you just blindly publish immediately without any regards towards those affected, that's both the customers and the companies involved, then you yourself with those responsible for the leak must face legal action as there is no difference between yourselves.

I'd suggest that you carefully read through MagicDude4Eva's reply and apply reason
http://mybroadband.co.za/vb/showthr...ked-online?p=17882325&viewfull=1#post17882325

 

[quovadis]

If you just blindly publish immediately without any regards towards those affected, that's both the customers and the companies involved, then you yourself with those responsible for the leak must face legal action as there is no difference between yourselves.

Of course there's a difference. If they published the location of the data or the data itself then sure I would agree with you but not in this case where it is a report on the event.

 

[MarshieZhanje]

Take down any sensitive information as soon as possible period!

 

[biometrics]

Take down any sensitive information as soon as possible period!

You are missing the point. It's published on websites you have no control over. It can't be taken down.

 

[km2]

I think MyBB did fine with the level of reporting they had with this story, and I CERTAINLY don't want anything that makes Google search less useful with the forums. Heaven knows it's the only way to find anything on here.

I also think that MagicDude4Eva is getting mighty sassy about the world of responsible disclosure, when he's not shy of blabbing all over the forum after trying for less than 30 minutes to report responsibly. Maybe his views have just evolved significantly over the last three years.

 

[frictionfree]

Disconnect the site immediately until it is secured and when returning, notify everyone for mandatory password change. Cover ups earn disrespect. Openness earns respect.

 

[cupcake]

From the affected companies side: The first priority is to reset the passwords and inform the affected customers immediately. Confirmation that this correspondence has been received by the customer should be recorded and resubmitted via a alternative channel until it is confirmed that all affected customers have been duly notified.
From Mybb: Liase with the affected company as far as possible but 48hrs is a reasonable time frame to allow before publication.

 

[CUDlybunny]

Publish as soon as you've been able to ensure the accuracy of what you are reporting on.

 

[Renier.Schutte]

Publish right away.

 

[MerlinKleyn]

No hard or fast rule on when journalist should publish. It all depends on the situation and when the journalist have all the facts at hand

 

[bauhmut]

This may have been said but IF there is a data leak and it is confirmed by the company....there should be no reason to wait. Steps should be taken by both parties to safeguard everyone.

 

[zafroggy]

While I voted immediately...

I feel that as a news and technical forum all due dilligence should have been taken. Including notifying the company should they be unaware.

Perhaps one can liase with the company to determine the impact and gain additional facts but this should not restrict the releasing of the details.

 

[Wana Beageek]

Information is the basis of sound decisions - I want to know there's a data leak as soon as possible so I can make decisions about the significance and possible impact of the data leak.

That being said, I want data leak information published as soon as confirmed as a bona fide data leak.

 

[Zoomzoom]

Why the blue blazes should the company - whose security failed - who didn't take good care of my data - get ANY preferential treatment? INFORM me IMMEDIATELY - I don't care who does, but INFORM ME, so I can take my own security steps - which would probably, if it was serious enough involve telling said company to f-off.

I take online security VERY seriously! It's bad enough I have to put ANY personal data out there, given that it seems almost f-ing impossible to find anyone who a. can protect it b. takes protecting it as seriously as I do, but to give the company who got hacked ANY way of avoiding telling me, fixing it in private, whatever is just WRONG!!!!

 

[redspark]

Once the affected company or organisation gathers the facts, it is in their best interest (and reputation) to inform their clients and the general public

 

[klopperg]

If MyBroadband is alerted to an online data leak, where sensitive data of South Africans is available online, how long should we wait until we publish an article about it?

Waiting for any period of time will not change the fact that the sensitive data has leaked. Publishing a report on where that data can be found is entirely another story.

 

[SauRoNZA]

Disconnect the site immediately until it is secured and when returning, notify everyone for mandatory password change. Cover ups earn disrespect. Openness earns respect.

I actually don't like the "change password" system.

Unless the accounts gets locked first and the only way to get in is the reset.

It's not secure while known password are out there and active.

 

[CanisLegis]

Without any doubt, as soon as the facts are available, they should be published. Information about data leaks are in the public interest and for the protection of the public the leak should be reported as quickly as is reasonably possible.