Insight - Going Going Gone?

Highly sensitive data, such as user names and passwords, of company executives has been found on second-hand computer disk drives bought on eBay.

Researchers at the University of Glamorgan analysed some 100 randomly sourced PC hard disks and discovered that more than half contained data from organisations such as multinational companies, universities and a primary school. Data on the disks included staff records, passwords, internal emails and financial details.

Attempts had been made by the previous owners of the hard drives to destroy data on nearly half the disks in the study, but significant material remained intact. “On at least seven of the disks I have seen there was enough information to allow a hacker to get into an organisation,” said Andy Jones, security research group leader for BT Exact, who examined the disks.

The government issues guidelines to businesses and public bodies on the proper disposal of computer equipment, much of it freely available online. But the University of Glamorgan research suggests that even the most diligent organisations can still be affected.

Information from Swedish insurance company Skandia was uncovered, even though the firm invests in data destruction. “This is not embarrassing for us; it’s absolutely horrifying,” said a Skandia spokeswoman. “We pay to have our data wiped thoroughly, so we are going to have to investigate and make sure it does not happen in the future.”

Southampton University says it launched an investigation after passwords and staff emails were discovered by the research. The university uses a specialist company to wipe disks before disposal of equipment. “We need to find out what happened and ensure it doesn’t happen again,” said a spokeswoman.

Agrochemicals company Monsanto says it will investigate how data of crop research from its Cambridge offices was found. “We assume this is an isolated incident which has arisen during the restructuring of our Cambridge offices, when a number of IT items were disposed of,” said a spokesman. “It seems a serious lapse in our procedures for the disposal of surplus IT kit has occurred.”

– This article was first published in our sister title Computing.