Major American Companies Are Making Basic Data Security Mistakes

Six months after the European Union's General Data Protection Regulation, or GDPR, took effect and threatening global companies with massive fines if they didn't look after customer data properly, new research suggests it's making a difference in Europe — but not so much for U.S. web users.


Personal information of American charity donors, political party supporters, and online shoppers has continued to quietly leak onto the internet as a result of poor website security practices. As many as one in five e-commerce sites in the U.S. are still leaving their customers exposed, New York-based search marketing company Seer Interactive reports.


Using simple Google searches, similar to methods examined by Seer, media giant Bloomberg was able to access sensitive user information from a wide range of randomly chosen U.S. websites.


In one instance, the website of St. Jude Children's Research Hospital had made public the receipt for a donation of hundreds of dollars, including the donor's full name and address, their method and date of payment, and their email. Bloomberg was able to find similar data in PDF format relating to purchases of sporting goods at the Pine Hills Golf Club in Hinckley, which included full names, home addresses and email details, as well as reference numbers for the person's purchase.


This vulnerability can be caused by a number of basic errors, one of which is that if a website lets a user share a transaction on social media — such as to promote a charitable donation — a search engine can see their post, and from there index the original web page, whether the user knows this or not. With no security protection in place, these pages are available to anyone.

more news

Europol Releases Latest IOCTA Report


Each year, Europol’s European Cybercrime Centre (EC3) publishes the Internet Organised Crime Threat Assessment (IOCTA), its flagship strategic report on key findings and emerging threats and developments in cybercrime — threats that impact governments, businesses and citizens in the EU.

read more

European Cybersecurity Month 2019 Is launched


October marks the kick-off of the European Cybersecurity Month (ECSM), coordinated by the European Union Agency for Cybersecurity (ENISA), the European Commission and supported by the Member States. This campaign will focus on expanding awareness about cybersecurity to citizens across Europe.

read more

Remote Desktop Attacks Increasing


The Remote Desktop Protocol (RDP) is being used by cyberattackers to penetrate and extract data from a network before introducing their malicious software to perform internal reconnaissance, according to a new Vectra 2019 Spotlight Report on RDP.

read more

LexisNexis Report On Cybercrime Has Shock Figures


LexisNexis Risk Solutions has released at the Digital Identity Summit its Cybercrime Report providing a comprehensive view into the shifting global fraud landscape from January 2019 through June 2019. During this period, the LexisNexis Digital Identity Network recorded 16.4 billion transactions, of which 277 million were human-initiated attacks, a 13 per cent increase over the second half of 2018.

read more