Vector to take Stuff to High Court; media agency refuses to hand over confidential breach data
Vector may take legal action against Stuff because the media agency apparently refuses to secure, to return or to destroy confidential data given to them by a hacker.
Last week Vector's Outage app was breached by an unknown third party, leaking personal information of up to 24,000 customers.
The personal information included customer names, emails, and postal addresses, but no financial information, Vector says.
Stuff informed Vector about the breach and Vector immediately disabled the Outage app. Further reports suggest that Vector was aware of the vulnerability, but did not know it had been breached until it was approached by Stuff.
However Vector says that the hacker provided customers' confidential data to Stuff. Despite repeated requests, Stuff has 'repeatedly refused' to hand it over, destroy it or secure it'.
Stuff editorial director Mark Stevens says that the story was in the public interest.
"The data was held only until we determined news gathering activities on this story had finished. When I was comfortable with that, I ensured the file containing customer contact details - which we received through a secure server - was destroyed," Stevens says.
Vector says, "Now that the story has been published we believe our customers' data should be destroyed or returned to Vector. Given Stuff's repeated refusals to Vector's requests, Vector now considers it has no choice but to take legal action to ensure its customers' private information is secured and protected. In our view not doing so would be tantamount to failing our customers again."
"As a result, Vector has applied to the High Court for an injunction to protect the information from further use. We recognise that taking this step is likely to attract further media attention to Vector for the original customer data breach. However, we considered it is more important to take whatever steps we can to secure our customers' data and protect their privacy.
However Stuff says that if it handed the data over to Vector, it could lead to identification of the source.
"We not only had the protection of the customer data to consider, but also the protection of our source. Source protection is a basic principle of what we do, and part of the stringent ethical framework we work under," Stevens says.
"When we obtain sensitive information we act responsibly, to protect both our sources and any vulnerable people affected (such as customers here)."
Vector says that a Stuff reporter has also approached at least one Vector customer with unsolicited questions.
Stevens explains: "We have, at all times, treated this information responsibly. Its circulation was limited to staff who needed to see if for news gathering purposes. We have not 'exploited' the information - and we do not sell or otherwise share confidential information we obtain during reporting."
"We fully accept Stuff had a valid right to report on the original data breach. We have made it clear to Stuff that we were not seeking to prevent their reporting on the matter and we have not asked them at any time to disclose their information source. However, we do not believe Stuff should have compounded this matter by exploiting the customer data when reporting on it," Vector says in a statement.
Vector says it is taking all steps to reduce any additional impact to its customers' privacy.
"In today's world, with the recent privacy related revelations about the likes of Facebook and the unauthorised use of personal information by third parties, we believe this is an issue that customers are increasingly aware of and concerned by.
Vector is working with IDCARE and the Office of the Privacy Commissioner to address its data security.
