{"id":78617,"date":"2013-05-24T11:26:44","date_gmt":"2013-05-24T09:26:44","guid":{"rendered":"http:\/\/mybroadband.co.za\/news\/?p=78617"},"modified":"2013-05-24T12:24:48","modified_gmt":"2013-05-24T10:24:48","slug":"personal-info-exposed-through-sa-bill-website","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/78617-personal-info-exposed-through-sa-bill-website.html","title":{"rendered":"Personal info exposed through SA bill website"},"content":{"rendered":"

Mobile payments provider POCiT<\/a> has drawn the ire of South African consumers today (24 May 2013) as it has been discovered that its Bills.co.za website exposes personal debt details.<\/p>\n

In e-mails forwarded to MyBroadband, consumers expressed their displeasure at some of their bill totals being available for anyone to see by simply entering a cellphone number or e-mail address, and corresponding date of birth.<\/p>\n

According to the reports from users, they did not sign up for POCiT\u2019s services, and MyBroadband was able to confirm that bill totals of people not registered with POCiT were available through the site.<\/p>\n

Asked about the privacy concerns raised over the site, new business development director at SureSwipe (a new brand that POCiT is being rolled into), David Reynders<\/a> said that they reacted immediately to reports from concerned users.<\/p>\n

\"bills.co.za

bills.co.za original landing page<\/p><\/div>\n

\u201cWe take this kind of stuff very seriously,\u201d Reynders said. \u201cSo the minute people contacted us we took the site down.\u201d<\/p>\n

The site has been live for around 3 years without complaint, Reynders said, but added that they are constantly responding to feedback from users.<\/p>\n

When they received a single complaint from a concerned user, Reynder said they \u201cjumped on this\u201d and decided to remove the manual search facility. Other parts of the site are still available, and attempts to access the search function following its removal from the site’s landing page were unsuccessful.<\/p>\n

\u201cWe\u2019re busy working on how we can do this better,\u201d Reynder said. \u201cWhile we work on this the search facility is down.\u201d<\/p>\n

Reynders said that the system offered manual search of Edgars, Jet, and Mr Price bills, with the purpose of giving people the minimum information needed to make a payment. \u201cWe are also in limited pilot with healthcare bills,\u201d Reynders said.<\/p>\n

\"Bills.co.za

Bills.co.za landing page taken down after complaints<\/p><\/div>\n

The system didn\u2019t display a full invoice or itemised break-down, but only bill totals, Reynders explained.<\/p>\n

Reynders emphasised that the site is secure and that payments made through it are done in a fully secure environment. The SSL details displayed by the browser when visiting the site appear to confirm this.<\/p>\n

He added that the manual search is a lightly used part of the site that does not generate much traffic, but that does not mean the privacy concerns are unimportant to them.<\/p>\n

\u201cMost people pay their bills based on custom links we send them, and those are not searchable.\u201d<\/p>\n

More on information security in South Africa<\/h3>\n

SAPS website hacker interviewed<\/strong><\/a><\/p>\n

SAPS website hacked, sensitive info leaked: reports<\/strong><\/a><\/p>\n

Spyware servers in South Africa: the plot thickens<\/strong><\/a><\/p>\n

Government spyware servers in South Africa: Telkom, Govt mum<\/strong><\/a><\/p>\n

Pay your municipal account from your cellphone<\/strong><\/a><\/p>\n

POCiT launches payments App for Android<\/strong><\/a><\/p>\n

Thanks to everyone who sent this in<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

Edgars, Jet, and Mr Price debt totals could be seen online if you had the cellphone number or e-mail address, and birth date of someone with debt<\/p>\n","protected":false},"author":15,"featured_media":74187,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[2998,19599,19597,35,4280,19601,2994,19603],"class_list":["post-78617","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-david-reynders","tag-edcon-group","tag-edgars","tag-headline","tag-jet","tag-mr-price","tag-pocit","tag-sureswipe"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/78617"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=78617"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/78617\/revisions"}],"predecessor-version":[{"id":78623,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/78617\/revisions\/78623"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/74187"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=78617"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=78617"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=78617"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}