M-Tech Systems

M-Tech Systems

M-Tech Systems was appointed by Peter Appleton to seek technical advice on a data breach involving a job application responses that were visible to anonymous users.

The data breach was reported to BBH by an external job applicant.

M-Tech Systems discovered the data breach was due to a user selecting an option within google forms to allow responses to be viewable. We saw no evidence any external party (such as hacking) was to blame.

To obtain information on what account changed, the default setting of the google form, a request to Google, will need to be made by BBH. The application for auidt information will be time-sensitive as Google will only hold audit information for a while.

Another issue was highlighted to M-Tech System during our visit.

A Google drive was made under Drik personal Google account before G Suit was fully introduced into the company. We believe this was due to testing and seeing if G Suit was variable within BBH with a view of moving the data over if the project went ahead. This personal drive which held all of BBH network drive data, and also job application form which caused the data breach.

However, up until the 1st Oct 2019, the personal Google Drive remained in opertaion. A discussion was made by BBH staff another Google drive should made within the corporate GSuit account and data copied from the personal account.

During the coping process, which took around 1 month, we cannot rule out the Google Forms setting was unintentionally changed until we request audit information from Google.

It was also pointed out Drik still has access via his personal Google Account, the original Google Drive (internally called Archive Drive), which had data up until 1st Oct 2019.

Drik has removed access to the Archive Drive in Jan 2020, meaning BBH has no control of this data set, but due to the copy in October, BBH hasn’t lost any data.

Drik Account has been suspended on the G Suit system however remains a sole Administrator for BBH on-line password manager – LastPass.

M-Tech Systems has advised BBH to contact LastPass support and remove Drik has an Administrator and reset all passwords afterwords. At this time, we have to warn BBH the IT systems and third-party on-line portals are not secure during the time Drik has access to LastPass.

Summary of Actions:

1)BBH to inform ICO the data breach was a user issue by a miss configuration of Google Forms and taken steps to remove all content viewable on-line.

An internal process of checking all Google forms will take place to ensure Google Form is configured correctly to protect personal data.

2)BBH to contact all job applicants sharing the same information as the ICO

3) Securing the IT systems – All on-line portals, including LastPass to have passwords changed and contact information updated (including recovery information)

4) All Google Accounts to have a password reset

5) The wireless password to be changed (including guest)

6) A review of G Suit security and settings (as this product was set up by Drik)