Hack Alert: Cupid Media Found In Breach Of Privacy Laws
- Friday, July 18 2014 @ 07:05 am
- Contributed by: ElyseRomano
- Views: 1,403
Bad news for Cupid Media and more than 200,000 of its Australian users: the online dating company has been found in breach of privacy laws.
Cupid operates more than 35 niche dating websites, including ChristianCupid, MilitaryCupid, SingleParentLove and other sites based on ethnicity, religion and location. Australian Privacy Commissioner Timothy Pilgrim found Cupid Media breached the Privacy Act by failing to take reasonable steps to secure data held on its websites. As a result of Cupid’s lax approach to security, hackers gained access to the company’s webservers in January of last year and stole the personal information of about 245,000 users. The information included full name, date of birth, email addresses and passwords.
At the root of the security breach is Cupid’s failure to have a password encryption process in place. "Password encryption is a basic security strategy that may prevent unauthorised access to user accounts," said Commissioner Pilgrim. "Cupid insecurely stored passwords in plain text, and I found that to be a failure to take reasonable security steps as required under the Privacy Act."
The commissioner added that the Cupid Media fiasco illustrates the importance of correctly handling personal information that is no longer needed, either by securely destroying or de-identifying it. “Holding onto old personal information that is no longer needed does not comply with the Privacy Act and needlessly places individuals at risk," he explained. "Legally, organisations must identify out-of-date or unrequired personal information and have a system in place for securely disposing with it.”
While online dating companies certainly do need to fiercely protect the massive amounts of personal data they gather, it’s also up to the daters themselves to take the most secure approach possible to dating online. Anyone using an online dating site should regularly update their privacy settings and change their password. It’s also important to remain vigilant about limiting the personal information you share. Only the bare minimums required should be posted online, or you risk becoming the victim of identity theft or a scam.
Commissioner Pilgrim noted that, on the plus side, "Cupid's vulnerability-testing processes did allow it to identify the hack and respond quickly." The company has addressed the security concerns and the investigation is now closed, but the commissioner warns against future attacks: “Hacks are a continuing threat these days, and businesses need to account for that threat when considering their obligation to keep personal information secure."
