Suffolk police databreach

[namitynamechange]

Appologies if theres already a thread on it - I couldnt find one. But FFS "An investigation has begun after the personal details of sexual abuse victims appeared on a police website."

www.bbc.com/news/uk-england-suffolk-63634650

Fucking hell, that's a horrific breach. They should be in serious trouble for it, regardless of how quickly they removed it.

That's awful and neither report says how long it was up. It also sounds like it was noticed by somebody accessing the public site rather than whoever was responsible realising what they had done and immediately removing it.

I read it as a member of the public accessing it too. That is horrendous and I hope whoever did it/approved it gets sanctioned. Its not a minor mistake inputting all that on a public website.

Hasn't Suffolk police been in the news recently over something else that's pretty bad?

Oh my Fucking God.

I'm too too too angry to form anything coherent at this moment.

My rapist has been dead for a number of years yet I still can't exist as myself on line in case his family/friends track me down.

Thankfully this isn't the police force I dealt with but if it was I'd be on the phone to a solicitor.

How dare they be so lax with the details of victims of crime, any crime. How bloody dare they.

Was this on the Suffolk police site, or the police and crime commissioner site? I don't understand why the PCC is apologising if it was on the police site. It should be the Chief Constable who apologises.

The penalties for data breaches (if found) are big:

ico.org.uk/for-organisations/guide-to-data-protection/guide-to-le-processing/penalties/

This is more than a data breach, that data shouldn't be anywhere near a public website.

I would imagine that they have multiple websites (an internal website for police use and a public facing website that connect to different databases), how the two have got mixed needs investigation, because it shouldn't be possible, a more likely possibility is that it was deliberate.

I know the person who discovered this data breach and he told me that sadly the police are trying to downplay the seriousness of this data breach, he was affected by two previous data breaches by the police himself and in one of them they refused to give the officer more training despite the fact she didn’t know the law.

Err wtaf?

We take our obligations under the Data Protection Act very seriously

clearly fucking not. How the fuck did this data get anywhere near the internet?

and why does this force apparently maintain a consolidated list of rape victims?

The article seems to minimise a heck of alot.

It was only up for a little while. Dont worry we fixed it.

Not the response you'd hope from the police but more than we've cone to expect t these days

I suspect that someone has made a Freedom of Information request on this subject (or someone in authority has decided to publicise it) and the respondent has published the base data instead of/as well as the aggregated figures. It's appalling, and is the reason you a) wouldn't extract the identifiable data (eg names, full addresses) unless you really really need to and b) should check everything yourself and then get someone else to have a look, too, before sending out ANYTHING, never mind stuff this sensitive.

As someone who has spent a long time dealing with other people's data this is appalling and if I realised I'd done it I honestly don't think I'd ever sleep again.

It is horrendous, the Police need to take more care - but also we all need to understand this is the sort of effect that comes when policing (and other service) budgets are cut - people have to rush, mistakes get made. Underfunded police = more harm to victims. Thank you Tories

There is an update on the Suffolk Police website which gives more detail about what happened:

www.suffolk.police.uk/news/latest-news/update-suffolk-constabulary-data-breach

I don't know if it makes it better or worse, tbh. At least they reported themselves to the ICO and removed all other FOI requests from their website.

If I read that correctly, the excel sheet was up on their site from 2019 until the 7th Dec this year.

And they were at least concerned about the possibility that other FOI answers might have contained PID - concerned enough to take them down.

excel sheet was up on their site from 2019 until the 7th Dec this year

It’s how I interpreted this part of their statement:

“As part of the inquiry, we are seeking to establish how many people have viewed the information. No other reports have been made to us since this document was first published in 2019”

Yep, it implies that the spreadsheet was put on the website as part of a FOI request response some time in 2019, but was only reported to them as a breach on Nov 7th this year. So an unknown number of people might have seen the data in that period of time, people may have downloaded copies and kept them etc etc. Suffolk police currently don't know, and may not be able to accurately establish either. Depends on what metrics they have access to for their website.

“The data was contained within an Excel document on the Suffolk Constabulary website. It related to inquiries into sexual offences and offences that occurred in schools which were reported between 1 April 2015 and 31 March 2019”.

Great so they’re not just careless with the data of rape victims, but specifically careless with data regarding child victims. Fabulous 😐