ICO Fines Gloucester City Council £100,000 For Heartbleed Hack

The affects of the Heartbleed exploit have been felt by Gloucester City Council after the Information Commissioner’s Office (ICO) fined the council £100,000 for leaving sensitive personal information open to attack.

Gloucester City Council suffered a data breach in July 2014 through cyber attack from a hacker who was able to make use of the Heartbleed, a bug in OpenSSL that can be exploited to enable hackers to read a system’s memory protected by versions of OpenSSL with the flaw.

Heartbleed can be used to exfiltrate data, eavesdrop on conversations and impersonate users or services; in the council’s case it led to the unauthorised download of more than 30,000 emails by a hacker claiming to be part off the Anonymous group.

Heartbleed effects

The hack, data breach and the subsequent results are an indication of the affect major bugs like Heartbleed can have if not fixed quickly.

The ICO took Gloucester City Council to task as it had ample time and warning to take action to fix the flaw. However, it failed to do so meaning personal information was put at risk when it could have been avoided and thus the data protection law was broken.

“This was a serious oversight on the part of Gloucester City Council. The attack happened when the organisation was outsourcing their IT systems. A lack of oversight of this outsourcing, along with inadequate security measures on sensitive emails, left them vulnerable to an attack,” said Sally Anne Poole, group enforcement manager at the ICO.

Problems stemmed from Gloucester City Council failing to have the proper processes in place to ensure their systems were updated when changing their suppliers.

“The council should have known that in the wrong hands, this type of sensitive information could cause substantial distress to staff,” Poole said.

“Businesses and organisations must understand they need to do everything they can to keep people’s personal information safe and that includes being extra vigilant during periods of change or uncertainty.”

The ICO takes no prisoners when it comes to organisations failing to update old systems to protect data; it recently criticised the Metropolitan Police Serviced for the security risks of continuing to use Windows XP.

Do you know all about security in 2017? Try our quiz!