Human Error Blamed For Visa Data Breach Down Under

The cyber risk factor posed by humans has been demonstrated after the personal health information of 317 people applying for Australian visas was leaked.

According to the ABC investigation, the data breach occurred after an email was mistakenly emailed to a member of the general public.

“The security bungle occurred when a spreadsheet was sent by mistake to an unknown individual’s email address, because of a typo,” said the ABC report.

Visa health leak

This data breach apparently happened back in August 2015, when Australia’s largest health insurance company, Bupa, and one of its subcontractors, Sonic HealthPlus (SHP) were contracted by the Department of Home Affairs to assess the health of people applying for visas and permanent residency in Australia.

ABC obtained documents under a Freedom of Information request by the ABC, and those documents showed that an SHP staff member accidentally sent the names, dates of birth, and passport numbers of 317 people, along with ‘brief notes, summaries and comments about the status of the medical tests being conducted’ to an unknown Gmail address.

The issue was so serious that eventually Google Australia intervened.

The Department of Home Affairs told ABC that the matter was immediately brought to their attention and fully investigated.

“The document contained bio-data details of visa applicants,” the department stated. “No actual personal client medical records were disclosed as part of this incident.”

The department reportedly added it was satisfied Bupa, and all of its subcontractors, currently only use systems that comply with the government’s data security protocols.

This is not the first time that there has been a data breach issue at Bupa.

In July 2017 a staff member at Bupa Global stole 108,000 international health insurance policies, and reportedly published it to the dark web. The employee was fired and legal action was taken against them.

Expert take

Security experts were quick to point out that humans remained one of the weakest links in any cyber defences.

“While on the surface it appears that breaches like these are easily avoidable, the fact is that humans are the still weakest link in our cyber security defense strategies,” said Stuart Sharp, VP of solution engineering at OneLogin.

“The details of the breach are still unknown, but with 4 out of 5 breaches involving human or process errors, companies and government bodies must do everything possible to prevent data breaches through technical controls and user education,” Sharp added.

Another expert questioned why the data transmitted via email was not encrypted or protected.

“Email is notorious for allowing errors such as attaching the wrong file, sending emails to the wrong recipient, or accidentally hitting reply all, instead of just reply,” said Javvad Malik, security awarenes advocate at KnowBe4.

“Which is why it is surprising to see hundreds of individuals private information being transferred via email with no apparent protection such as making an attempt to encrypt the information within,” said Malik.

“Many technologies exist that can be used to transfer and share sensitive information in a controlled manner that can be monitored and audited,” he added. “There is no excuse for governments or companies to be sending so much data through unprotected channels.”

Do you know all about security? Try our quiz!