By John Oates
28th August 2008
The man who paid 35UKP for a server stuffed full of Royal Bank of
Scotland and NatWest customer details has been left less than impressed
with the reaction of UK data regulators.
Andrew Chapman's story hit the news after he bought a server on eBay
which contained over a million customer details including full account
details, mothers' maiden names, addresses and even scans of signatures.
But neither the Financial Services Authority nor the Information
Commissioner's Office contacted Chapman when he went public with what he
found inside the machine.
Chapman said he phoned the Information Commissioner Office's head of
investigations and offered him the machine. Instead he was told to
return it to Graphic Data.
Chapman, an IT manager from Oxford, told the Reg: "I don't really see
how either the FSA or ICO can ascertain what happened by relying on
Graphic Data. It is a nonsense to ask companies to self-report." He said
he was told the ICO had no power to seize equipment - although that
clearly would not have been necessary in this case.
Register now for HITBSecConf2008 - Malaysia! With
a new triple-track conference featuring 4 keynote
speakers and over 35 international experts, this
is the largest network security event in Asia and
the Middle East!