Bloody Hell, you can buy anything on Ebay these days

[Grumpmeister]

Royal Bank of Scotland customer data anyone? 

An investigation is under way into how a computer containing bank customers' personal data was sold on an internet auction site.

The PC, which was reportedly sold for £35 on eBay, had sensitive information on the hard drive.

The Royal Bank of Scotland (RBS) and its subsidiary, Natwest, have confirmed their customers' details were involved.

RBS says an archiving firm told it the PC had apparently been "inappropriately sold on via a third party".

It said historical information relating to credit card applications for their bank and others had been on the machine.

The information is said to include account details and in some cases customers' signatures, mobile phone numbers and mothers' maiden names.

RBS and Natwest - two of the three businesses involved - said they are taking the issue very seriously and are working to resolve it "as a matter of urgency".

A spokeswoman for data processing company Mail Source, which is part of the archiving firm Graphic Data, said it was investigating how the computer equipment had been removed from a secure location.

"The IT equipment that appeared on eBay was neither planned nor instructed by the company to be disposed."

She said the incident was extremely regrettable and the firm was "taking every possible step" to retrieve the data and ensure it was an isolated incident.

The problem came to light when IT manager Andrew Chapman, 56, from Oxford, bought the computer, noticed the data and raised the alarm.

He said: "I was appalled when I found the bank account information. That sort of thing shouldn't have been listed on there."

Mr Chapman said anyone with a basic knowledge of computer software would have been able to find the data fairly simply.

"The information was in back-up CDs and in ISO files so it would have been possibly quite easy to find if you know something about computers," he said.

The Daily Mail said the computer, containing a million bank customers' personal data, had been sold for £35.

A spokesman for eBay said they were currently looking into what had happened.

"Clearly such details should never have been included in the hard drive of the computer offered for sale on eBay. We fully expect Mr Chapman to hand it back to Graphic Data as soon as possible. We will of course work with Graphic Data to establish how it came to be available for sale on our site."

Banks have an obligation under the Data Protection Act to keep all personal information secure.

Last year the Financial Services Authority fined the Nationwide Building Society £980,000 for a security breach, after a laptop containing customer data was stolen from an employee's home.

A spokeswoman for the third company reported to be involved, American Express, said it took the security of its card members' data "extremely seriously".

"We are currently working as a matter of priority to establish exactly what data is impacted and identify the card members who may be affected," she said.

[Snoopy]

MUCH more importantly ~ when did you ever see a working laptop on ebay for 35 quid? Most seem to go for about £100+ if they are any good. Even those advertised for spares tend to fetch around £40.

[Grumpmeister]

It would depend on the laptop itself and how it was listed. Bear in mind that if you have the patience you can find some real bargains on there because the seller is a total berk and cocks up the listings. I ended up with a £300+ PDA for £35 because of that happening.

[Snoopy]

  So you are saying don't look under laptops but hunt through various other pages.

[Nick]

See also:sexophone 

[Grumpmeister]

Well I found the PDA while looking for memory for my PC Snoop. it came up when I searched RAM.

[Snoopy]

People are bloody strange. 

[Nick]

See also:Wenchy

[Grumpmeister]

See also:Nick

Corrected it for you... 

[Barman]

See also:Nick

Corrected it for you... 

[Darwins Selection]

So you are saying don't look under laptops but hunt through various other pages.

Try 'lapdance' instead. 

[Nick]

See also:Nick

Corrected it for you... 

 

[Grumpmeister]

The day after the RBS, a council does the same thing 

A Leicestershire council is investigating a report that a computer containing taxpayers' personal details was sold on auction website eBay.

Bank account numbers and sort codes of people in the Charnwood Borough Council area were reportedly found after the equipment was sold for £6.99.

The authority said it was urgently investigating the matter.

The security scare comes a day after it was revealed a computer which held data on bank customers was sold on eBay.

An investigation is under way in that case after IT manager Andrew Chapman bought a computer on eBay, not knowing that the hard drive contained personal information relating to bank customers.

Information including bank account numbers, telephone numbers, mothers' maiden names and signatures of customers of American Express, NatWest and the Royal Bank of Scotland (RBS) were reportedly found on the computer.

The Information Commissioner's Office (ICO) - the UK's privacy watchdog - is investigating both cases.

The independent regulator can issue enforcement notices to organisations responsible for breaches of the Data Protection Act, forcing them to tighten up their security measures.

Commenting on the Charnwood Borough Council case, an ICO spokeswoman said: "We were informed yesterday (Tuesday) that another computer appears to have been bought on eBay and contains the personal details of what sounds like thousands of people. We are investigating."

Borough council leader Richard Shepherd said: "At the council we must clearly find out what happened, what went wrong and how it occurred and if the council is somehow at fault in this - we must that right."

A Charnwood Borough Council spokesman said: "It is Charnwood Borough Council's policy to securely dispose of all computer hardware.

"No hardware is ever resold, donated or given away to any party, staff or otherwise.

"We ensure that every disposal of equipment is carried out by a reputable third-party organisation who provide certification for each batch of disposed equipment, stating that drives have been wiped, or are destroyed."