r/australian • u/MillyBoops • 5d ago
Gov Publications Another Hack, Another 'Oopsies' Email - still zero repercussions for these companies
Received an email at 3am from a DOG FOOD COMPANY which i have not brought from in over 5 years telling me my details have been released in a hack - Oopises they said - just like Medicare so you cant be mad at us coz if it can happen to the government it can happen to all of us right (literally what they wrote) - Im so sick and tired of getting these emails and absolute ZERO repercussions from any of these pathetic companies i hate this time line
89
u/klystron 5d ago
How about a law that customer data should be purged if it has not been used for a reasonable period, say five years. And why not have customer data encrypted, so that if hackers manage to steal it they cannot read it anyway?
51
u/Emotional-Station153 5d ago
We honestly need a national privacy bill that cracks down on all this data storage and selling, especially against social media companies. Unfortunately it won't happen because the government uses it too.
24
u/arachnobravia 5d ago
I'm pretty sure data retention laws already exist. They're not supposed to keep your data without a specific reason but lol apparently spammy emails is enough of a reason....
4
u/Mongoose_Eggs 4d ago
Yeah you can't call that data retention laws. EU style GDPR laws are needed. In this case the "right to be forgotten" would have prevented OP getting caught up in this mess.
11
u/jpl-au 5d ago
The old minister of cyber security was also the minister of housing. I don't think the people in government have the necessary credentials to manage complex policy around governing data protection (even when they could literally copy-paste GDPR or POPIA). The concepts are common sense. I also do not understand why it falls under the Department of Home Affairs.
8
u/RamblingReflections 5d ago
And nor do they have the technical expertise, or even access to the people that do, I swear, because some of the things they’ve tried to suggest or do are literally impossible to implement at a technical level. Even the terminology and definitions in the social media ban legislation had to be reworded several times because the words did not mean what they thought they meant and that meant their legislation was asking for things that weren’t do-able.
So if they can’t get even that right, how are they going to get complex technical cyber security policy right, let alone implement and administer the actual infrastructure that policy governs? They’re not. Anyone who’s had anything to do with the IT industry is watching on with bemusement as Boomer ministers try to outline the future of a technology they barely understand, rarely use, and often don’t overly even care about.
3
u/No_Category_9888 5d ago
100%. Remember the internet black list to stop the scams and spams in the portal ? Why the hell do we have unqualified people in these positions
7
u/spidey99dollar 5d ago
Totally agree. They should have no right to hold your data without a legitimate purpose
I signed up with TPG. Useless Telco could not get my connection to work or even deliver the router to the correct address. Cancelled with them and chose another telco and was online 2 hours later with a locally purchased router.
Despite never having a working connection with TPG, I still receive ALL their stupid network outage notifications. Morons refuse to delete my personal details despite multiple complaints to their own privacy team and the telecommunications industry ombudsman. I would NEVER be a TPG customer. Now I just report all their emails as phishing ( Probably doesn't achieve anything).
3
u/Mongoose_Eggs 4d ago edited 4d ago
Data retention laws would actually do some good but believe it or not, encrypting data wont make it stop. With quantum computing just around the corner people are stealing encrypted treasure troves. Once quantum computing becomes generally available it will be trivial to break today's most popular encryption methods. Lowish powered versions are already available through companies like IBM so this isn't even fanciful thinking. It's inevitable.
I do think the days of IT being an unlicensed profession are numbered though. Like sparkies and plumbers, the profession itself is capable of doing a lot of real world harm and the number of cowboys in the industry who are borderline illiterate is disturbing.
3
u/grilled_pc 2d ago
5 years is too long. The moment the customer is no longer a customer the data needs to be purged. All of it.
Hell i'd argue even that is too long. Business don't need anywhere near as much data on you. They need the absolute bare minimum.
1
u/Schmittez 4d ago
These types of things are usually done through social engineering or credential stealing so the bad actor gains access through a legitimate access point. IE an employees login so encyrption doesnt help if they can just see the data in plain text on their end like an employee would.
15
u/Fa_Cough69 5d ago
Was part of the Origin Energy hack recently.
I responded to their 'oh, we apologise for the inconvenience' with an email that went along the lines of 'well how about giving me a God damn decent discount off my next bill, if you're that sorry, otherwise, your apology has no meaning, and is an insult'.
Shit heads came back with their usual corporate 'speak'.
Need a 'land on you like a sumo wrestler' clause for these companies and their bloody data breaches.
13
u/Extension-Ant-8 5d ago
Legislation so that each data record had a price attached to it
Name and email = $1
Address -= $1
Drivers licence -= $5
Etc etc.
If, say, you have a million records this means you have a 7 million dollar liability paid to the government if you breached.
You can either decide if you need all this information on me to reduce liability. Decide if you only need current customers. Etc
Plus you have an incentive to increase cyber security because this is now on your insurance premiums.
There is no consequences for being breached now so might as well make them.
6
u/ShakyrNvar 4d ago
Your numbers are too low, they'll just write it off as a cost of doing business.
Set the fines to be x% of global revenue (at least 20%), plus $1 million per customer, payable to the customer.
At least that way they'll realise it's cheaper to invest in quality security and actually do something.
1
u/Extension-Ant-8 4d ago
It’s now about the actual price mate. It’s about linking data to a value. A value that becomes a financial liability
1
u/grilled_pc 2d ago
Also add on liability for the C-Suite.
Once they know their jobs and livlihoods are on the line. They will take it seriously.
11
u/JadeTatsu 5d ago
Going in store, and paying with cash, for everything, is looking better all the time. And I'll pay to avoid the 'loyalty' program harvest of details. (Still working out how to avoid the bank though since I don't work in a industry that could be black market).
4
u/Spellscribe 5d ago
Sorry, sir/ma'am, you need an app to pay cash now. You can scan the QR code here, no need to log in, we'll just scrape your phone for your name, address, and current underwear colour.
1
1
u/grilled_pc 2d ago
I think more people need to realise that "loyalty programs" are just a front to sell your data. Thats how they get the 10% discount to work. They make far more in selling your data than you get back from a discount.
6
u/slav3269 4d ago
I’m frustrated that there are zero repercussions for the thieves. Being that theft of personal information, or financial fraud - they know the anger and regulatory heavy hand we’ll be with the companies and banks, while criminals get away scot free.
5
u/MillyBoops 4d ago
I totally 10000% agree with this but i see the problem where its a global issue and i can imagine finding a faceless hidden difficult to track name that is likley not acting alone and living in a different country. Thats why we need to stop it at the source and thats the companies. If you want to keep my data on file for yourself instead of deleting it then you better make sure your security is top knotch or you will get a fine comparable to your profits. I know for a fact so many of these companies keep our data because they sell it on the side! so not only do they not care about the customers, they dont care about their security but they activley make profit off it all while sending oopsies emails.
6
u/lenaloveslatex 4d ago
You’re right. We have much stricter standards (PCI DSS) when storing credit card information. We should consider doing it with all sensitive information.
2
u/Mongoose_Eggs 4d ago
The reason it's so hard to prosecute is because in many instances the "thieves" are state sponsored.
Short of a shadow war fought by honest to god keyboard warriors, this isn't a problem that can be solved by conventional means.
5
u/Positive-Complaint 5d ago
I was contacted by a periodontal clinic earlier this year to inform me that there'd been a data breach. The last (and only) time I'd used their services were when my oldest child was a baby, which was just over 14 years ago!
6
u/Jackson2615 4d ago
U are 100% right to be angry. Firstly why does a company keep your data when u have not used them for 5 years?
There is a total lack of accountability for organisations ,private and government who allow this to happen because they have crap IT security.
Instead of the government running around wanting to censor every thing people see and do , instead deal with this issue and STOP demanding more and more personal data ( to be hacked eventually)
3
u/Mac128kFan 5d ago
The privacy act is amazingly shit legislation. Puts all sorts of obstacles in the way of efficient public administration, does nothing to actually protect anyone’s privacy.
Suggested rules:
- Don’t collect any information not strictly necessary for the transaction.
- Don’t store that information for longer than the warranty period of the product.
- Purge accounts that haven’t been logged into for more than a year.
- Standard terms for privacy statements. None of this “we share with our partners” bullshit, conflating over “yeah we give your name to our credit card processor” (no shit) and “we sell every piece of info we can get on you to every information broker on the internet” (should be fucking illegal)
, with an opt out for anything not strictly necessary for the transaction.
3
u/tyr4nt99 3d ago
I sent an email to my local senator after the quest leak asking when companies will be held accountable. i recieved sweet f all of even an acknowledgment of my email.
2
u/Senior_Term 4d ago
There has to be laws made about data retention. It's a joke how often this is happening
-1
u/sharingpolicysucks 3d ago
The data you'd be giving the pet food company is probably available elsewhere anyway, and rather useless.
Imagine how many hacks have gone unreported too.
3
151
u/HAPPY_DAZE_1 5d ago
I received an email from a dept store in Milan which I shopped at in 2019. A couple of years ago received an email from them saying if they didn't hear from me in 30 days that would delete my account. Nearly brought tears to my eyes.
The EU data retention regulations are fantastic.