9. Too much information, commissioner

Posted on 17 Jun 2008 at 10:28

Gaffe rating: 118

Information Commissioner Richard Thomas was outraged following the HMRC data disc scandal, issuing warnings about the potential for ID fraud. The ICO website even advised that "before you create a profile, post a picture or tell the online world what you're doing, think about how to make sure that you're safe online".

He must have been a little embarrassed then, when in December 2007 The Independent newspaper carried a story revealing how security consultancy SecureTest had managed to uncover the details of three bank accounts held by Mr Thomas, along with his age and home address, all within the space of 30 minutes online. Ken Munro, SecureTest's managing director, told us that it was ironic that they "were able to collate enough information to steal his identity just by using search engines".

Munro also found Thomas' children's names and occupations, education information, details of weekly movements including which flights he boards, his wife's maiden name and date of marriage, and even the balance of his bank accounts.

Thomas' embarrassing exposé highlights the dangers of information spilling on to the internet. "One of the biggest problems SecureTest has found when conducting this type of investigation is the use of work email addresses on forums and networking websites," Munro advises. "These can be used to conduct individually targeted email campaigns sometimes referred to as 'spear phishing' and is an area that businesses can take action on now to ensure acceptable use." We're sure the ICO will be updating its website with that advice shortly.

Next: 8. TomTom takes a wrong turn

The 10 worst security gaffes

Author: Davey Winder