Irish cops data debacle exposes half a million motorist records

A third-party contractor moving a database without password protection exposed much than 500,000 records related to conveyance seizures by nan Irish National Police (An Garda Síochána, "Garda").

Security interrogator Jeremiah Fowler recovered various records making love backmost to 2017 including scanned personality documents, security investigation inquiries, certificates of conveyance registration, and different perchance delicate data.

Incident summary reports were besides among nan documents exposed. These included names and specifications of drivers, witnesses, and aggregate Garda officers.

Fowler's investigation revealed "approximately 2 to 5 documents related to each individual case" exposed connected nan database, an penetration he extrapolated to foretell astir 150,000 conveyance owners being affected by nan incident.

The conveyance seizures were carried retired by nan Garda, but nan database is wholly owned and operated by an unnamed, Limerick-based contractor, which was reportedly highly responsive to reports and remediated nan rumor promptly.

Asked astir nan findings, a Garda spokesperson told The Register: "We don't remark connected third-party materials."

It offered a much important consequence to nan Irish Independent newspaper, saying an investigation had been launched "immediately."

"Under An Garda Síochána's statement pinch individual towing companies, location are clear obligations connected individual towing companies to protect immoderate accusation supplied to them by An Garda Síochána including individual data," nan spokesperson told nan publication.

"This responsibility besides extends to situations wherever individual towing companies supply this accusation to a 3rd statement for retention purposes."

During nan disclosure process, Fowler told The Register that he wasn't privy to whether location was grounds to propose malicious actors had accessed nan database aliases exfiltrated data.

He believes nan entree to nan nationalist unreality retention repository could person been group to "public" successful error, since entree needed to beryllium unfastened to aggregate organizations, including nan constabulary and towing and retention companies.

"These documents are needed for nan towing and retention companies and nan constabulary to person entree astatine immoderate time, and this could person been wherever nan correction occurred and nationalist entree was opened," he said.

"It is simply a immense symptom successful nan ass to participate a password for each document, but someday we will request to sacrifice convenience for security. It will beryllium achy but I judge nan days of nan 1 database afloat of everything will beryllium extinct successful nan future."

Mounting constabulary breaches

The latest revelation follows a agelong statement of stories related to various constabulary forces successful nan UK each reporting information incidents successful caller months.

• Northern Ireland constabulary whitethorn person endangered its ain officers by posting specifications online successful error
• Cumbrian Police accidentally people each officers' specifications online
• You're not seeing double – yet different UK copshop is confessing to a information leak
• More UK cops' names and photos exposed successful supplier breach

It each started pinch nan Police Service of Northern Ireland (PSNI) posting a spreadsheet afloat of names and locations of its serving officers backmost successful August, arsenic good arsenic civilian unit members.

The incident occurred owed to nan PSNI mistakenly posting online a consequence to a petition made nether nan Freedom of Information Act 2000 (FoI) pinch excessively overmuch information.

Speaking astatine nan time, nan Chair of nan Police Federation for Northern Ireland, Liam Kelly, said that if location addresses had been included successful nan leak, nan PSNI would person faced "a perchance calamitous situation."

Days later, Cumbria Constabulary became nan 2nd constabulary unit successful nan state to disclose officers' individual information. This clip it was nan names, salaries, and allowances of each officers. 

The unit confirmed successful a connection that quality correction was to blasted erstwhile nan archive was uploaded to its website successful March.

Again, conscionable days later successful what was a chaotic fortnight for constabulary information leaks, Norfolk and Suffolk constabulary forces confirmed they had leaked earthy crime study information successful FoI responses.

London's Met Police followed suit later successful August, disclosing that a third-party breach exposed officers' names, photos, salaries, and more.

Greater Manchester Police besides announced successful September that a third-party supplier of ID badges had been attacked pinch ransomware, which past led to theft of information relating to nan names and photos of its officers. ®