Red Cross Blood Service incident. The Australian largest ever leak of Personal data

The Australian Red Cross Blood Service confirmed the data leak that exposed a backup database containing the personal details of donors.

This data leak is considered by security experts one of the most severe due to the nature of the target, the Australian Red Cross Blood Service. The sensitive database was discovered on October 24 by a security expert that was scanning the Web for exposed web servers.

One of its third-party service providers inadvertently exposed a backup database containing the personal details of 550,000 individuals.

The database remained accessible online between September 5 and October 25.

The man who discovered the database reported his discovery to the popular security expert Troy Hunt who runs the data breach notification service haveibeenpwned.com.

The 1.74Gb database contains 1.3 million records containing the name of donors, gender, date of birth, country of birth, physical and email addresses, phone number, blood type, type of donation, donation dates, and eligibility answers.

“In the Red Cross’ case, the data that was ultimately leaked was a database backup. That 1.74GB was simply a mysqldump file that had everything in it. Taking a database backup is not unusual (in fact it’s pretty essential for disaster recovery), it’s what happened next that was the problem.” wrote Troy Hunt in a blog post.

“The database backup was published to a publicly facing website. This is really the heart of the problem because no way, no how should that ever happen. There is no good reason to place database backups on a website, let alone a publicly facing one. There are many bad reasons (usually related to convenience), but no good ones.”

Hunt reported the issue to the Red Cross and the ausCERT, meanwhile, the Australian Red Cross Blood Service reported the incident to the Australian Cyber Security Centre, Federal Police and the Office of the Information Commissioner.

According to the Australian Red Cross Blood Service, the database contains registration information for 550,000 individuals who had donated between 2010 and 2016.

“This file contained registration information of 550,000 donors made between 2010 and 2016.  The file was part of an online application to give blood and information such as names, addresses, dates of birth and some personal details are included in the questionnaire.” states the announcement published by the organization.

It is still unclear is someone else accessed the database, anyway IDCARE, Australia and New Zealand’s national identity support service have determined that there is low risk for the donors.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Australian Red Cross Blood Service, data leak)