Glitch in Tax Service Exposed 1.2 Million Danes' CPR Numbers
People who have a tax liability to Denmark are allowed by TastSelv's services to see and alter their tax returns, annual statements and pay residual tax. As per the findings of the security researchers at the agency, all the exposed data was found to be encrypted and hence reportedly, Google and Adobe were not able to view the same due to encryption which barred them.
Other sources have it that in an attempt to downplay the entire incident, The Danish Agency for Development and Simplification put forth a solid confirmation on the CPR numbers being encrypted when accessed by the companies. Meanwhile, cybersecurity specialist and founder of the CSIS group, Peter Kruse asserted that Google did access those 1.2 million CPR numbers as there was no encryption, according to him the numbers were rather in plain text.
How was the glitch exploited?
It was when the users who were logged into TastSelv Borger happened to click on the text displayed as 'Correct contact information' and consequently rectified the contact information, faced an error in the app. The error triggered the process of transferring the CPR numbers to Google and Adobe, as per DR news website.
Referencing from the statement given by the government agency, “We take this kind of case very seriously. And of course, we need to be able to make sure that our suppliers handle all data according to applicable law and within the framework agreed upon with them.”
“The data received by Google is unencrypted. Google has been able to read data in unencrypted form,” he added.
“Google Hosted Libraries have been designed to remove all information that allows identifying users before logging on. Thus, no user information is shared with Google in this process.” Google told the website which first reported the incident.
from E Hacking News - Latest Hacker News and IT Security News https://ift.tt/2Hh8TS2
Comments
Post a Comment