Security threats Toolkit

Upgrade error exposes taxpayers' data

Colin Barker ZDNet.co.uk

Published: 30 Aug 2005 13:10 BST

The security of Lambeth Council's online council tax payment system was compromised last week, after a routine software upgrade.

The glitch led to personal details of local residents who used the service being emailed across the Internet as plain text. This included credit card numbers, card expiration dates and council tax numbers.

Speaking to ZDNet UK, one Lambeth resident said he had paid his council tax to Lambeth Council last Thursday using the online payments system provided by Capita.

According to the resident, the system worked well until he was sent a confirmation email, which contained his council tax number, card number, his name, expiration date, authorisation code, email address and the merchant's number, all in plain text in an email.

The resident immediately emailed the council pointing out that his details had "been exposed, against all good security practice". He received a prompt reply, but not an apology, from the contract manager at Lambeth Council, who explained the "problem existed for a short time only after an upgrade to the software".

The problem came about when the "STOP function that anonymises credit card details" was turned off during the upgrade, the contract manager said.

A spokeswoman for Lambeth Council told ZDNet UK that she had been told by Capita that the system was affected for two days and that it happened when the system "did not apply a mask that should cover the numbers".

The spokeswoman could not say how many residents had been affected by the fault. "We have asked [Capita] but they have not been able to tell us yet", she said on Tuesday, four days after the fault was first reported.

It was "unacceptable for this information to be displayed" the spokeswoman said, adding that the council had been reassured by Capita that adjustments had been made to the software so that the situation "could not happen again".

In May 2001, Lambeth Council cut short a £48m contract to outsource its benefits system to Capita claiming that the system of paying benefits had deteriorated over the previous four years.

Did you find this article useful?
61 out of 129 people found this useful

Post a comment

Full Talkback thread

1 comment

Did you make a serious typo in this article or was... Mick Fandango

More In Security threats

Company/Topic Alerts

Create a new alert from the list below:

Related Jobs

Council Tax Manager - West Midlands - Contract

My public sector client based in the West Midlands is seeking a Council Tax Manager to fulfil an initial six-month contract within a months time. The ...

Product Development - Equities Top Tier structurer tax efficient

Experience developing platforms such as issuance vehicles etc Strong understanding of tax legal and accounting issues a must, particularly the tax ...

Global Hedge Fund , Tax Country Manager VP / Director Apply Now

My client a international multi strategy hedge fund has a rare requirement for a tax professional to come on board and responsibility for its UK ...

Featured Talkback

On the contrary, if vendors were forced to stand behind their products it should increase innovation. It would force more, and better , testing before hitting the sales floor, resulting in fewer updates and less downtime for the consumer. At present the EULA removes responsibility from the vendor, and moves it to the user, which is a step backward. Make the vendor responsibility for their code.