NIB private health fund customers logging onto their online portals yesterday were able to view other NIB customer’s mobile numbers, email addresses and claims history between 10.33am and 11.35am.
Alarmed customers notified NIB about the problem and Fairfax reports customers were still able to access the portal 30 minutes after phoning the insurance company.
A spokesperson for NIB told SmartCompany this morning the insurer can confirm “no credit card information of any customer was displayed.”
“Nib apologies unreservedly to the customers affected by this issue. Nib takes the privacy of our customers very seriously and has also taken the step to key stakeholders including our regulator and ombudsman,” the spokesperson said in a statement.
Customers have since lashed out about the incident, with many taking to Facebook about the lack of communication around the incident.
Michael McKinnon, security adviser for AVG, told SmartCompany there are steps small businesses can take in order to prevent a breach.
The information leak affected 329 customers who accessed online services during this time and McKinnon says “as our business systems become more complex over time it’s a given that you’ll end up with more software bugs becoming a threat”.
Here are four security lessons for your business from the breach:
In our society, a business’ website is more often than not a customer’s first point of contact, and with more and more businesses incorporating online portals into their operations, online security is crucial.
“A fundamental mistake SMEs make is that they have their own web developers testing their sites. That’s never as good as having someone else test your site,” say McKinnon.
“Sometimes it can be a case of the SME owner thinking like a hacker. If this was someone trying to come after your business and your held data, you have to think about what they might try and do it to see if it works.”
By only keeping the necessary information on your database it minimises the scale of the risk your company faces, should a breach occur.
“The privacy principle your database should be adhering to is to only be keeping information for critical function. If you don’t need it, get rid of it,” says McKinnon.
Reducing the “attack surface” or “security footprint” your company stores will make your operating system perform much smoother and limit the potential for information to become compromised.
The web platforms used by a business are crucial to not only the way your platform runs but also the bugs you can be exposed to.
In terms of the technology side, ensuring the web platforms and all the systems are connected, maintained and up to date is crucial. This need to be done regularly,” says McKinnon.
“Security bugs can be found in common web platforms, such as WordPress, and when security patches are released by these platforms your company needs to make sure they’re installed and active – as they are common knowledge to hackers.”
Following the initial temporary disabling of the company’s website, a crisis plan should be put into action.
McKinnon suggests SMEs have a pre-written document in the event of a database breach, saying “businesses shouldn’t ever find themselves in a position to deal with this unprepared”.
McKinnon recommends:
