Story image

Vector to take Stuff to High Court; media agency refuses to hand over confidential breach data

04 May 2018

Vector may take legal action against Stuff because the media agency apparently refuses to secure, to return or to destroy confidential data given to them by a hacker.

Last week Vector’s Outage app was breached by an unknown third party, leaking personal information of up to 24,000 customers.

The personal information included customer names, emails, and postal addresses, but no financial information, Vector says.

Stuff informed Vector about the breach and Vector immediately disabled the Outage app. Further reports suggest that Vector was aware of the vulnerability, but did not know it had been breached until it was approached by Stuff.

However Vector says that the hacker provided customers’ confidential data to Stuff. Despite repeated requests, Stuff has ‘repeatedly refused’ to hand it over, destroy it or secure it'.

Stuff editorial director Mark Stevens says that the story was in the public interest. 

"The data was held only until we determined news gathering activities on this story had finished. When I was comfortable with that, I ensured the file containing customer contact details - which we received through a secure server - was destroyed," Stevens says.

Vector says, “Now that the story has been published we believe our customers’ data should be destroyed or returned to Vector. Given Stuff’s repeated refusals to Vector’s requests, Vector now considers it has no choice but to take legal action to ensure its customers’ private information is secured and protected. In our view not doing so would be tantamount to failing our customers again."

“As a result, Vector has applied to the High Court for an injunction to protect the information from further use. We recognise that taking this step is likely to attract further media attention to Vector for the original customer data breach. However, we considered it is more important to take whatever steps we can to secure our customers’ data and protect their privacy.”

However Stuff says that if it handed the data over to Vector, it could lead to identification of the source.

"We not only had the protection of the customer data to consider, but also the protection of our source. Source protection is a basic principle of what we do, and part of the stringent ethical framework we work under," Stevens says.

"When we obtain sensitive information we act responsibly, to protect both our sources and any vulnerable people affected (such as customers here)."

Vector says that a Stuff reporter has also approached at least one Vector customer with unsolicited questions.

Stevens explains: "We have, at all times, treated this information responsibly. Its circulation was limited to staff who needed to see if for news gathering purposes. We have not 'exploited' the information - and we do not sell or otherwise share confidential information we obtain during reporting."

“We fully accept Stuff had a valid right to report on the original data breach. We have made it clear to Stuff that we were not seeking to prevent their reporting on the matter and we have not asked them at any time to disclose their information source. However, we do not believe Stuff should have compounded this matter by exploiting the customer data when reporting on it,” Vector says in a statement.

Vector says it is taking all steps to reduce any additional impact to its customers’ privacy.

“In today’s world, with the recent privacy related revelations about the likes of Facebook and the unauthorised use of personal information by third parties, we believe this is an issue that customers are increasingly aware of and concerned by.”

Vector is working with IDCARE and the Office of the Privacy Commissioner to address its data security.

Read more about the breach here.

Why 'right to repair' legislation could be a new lease on life for broken devices
“These companies are profiting at the expense of our environment and our pocketbooks as we become a throw-away society that discards over 6 million tonnes of electronics every year.”
Hands-on review: Huawei Watch GT
I’ve thoroughly enjoyed my time with the Watch GT. It’s converted me from being anti-smartwatch to someone who’s genuinely considering buying one.
How NVIDIA aims to kick-start next-gen gaming
Integrating into game engines new features such as real-time ray tracing can accelerate the development process.
Huawei talks P Series history - and drops hints on the P30
Next week will see the covers come off the new Huawei P30 Series at a special launch event held at the Paris Convention Center.
Hands-on review: Xiaomi’s Mi Mix 3 and the Amazfit Bip
You’ll probably be sad to see another device say ‘farewell’ to the 3.5mm headphone jack. Fortunately though, as mentioned, Xiaomi were kind enough to include an adapter in the box.
How Cognata and NVIDIA enable autonomous vehicle simulation
“Cognata and NVIDIA are creating a robust solution that will efficiently and safely accelerate autonomous vehicles’ market entry."
Kiwis know security is important, but they're not doing much about it
Only 49% of respondents use antivirus software and even fewer – just 19% -  change their passwords regularly.
Instagram: The next big thing in online shopping?
This week Instagram announced a new feature called checkout, which allows users to buy products they find on Instagram.