[mooks]

http://news.bbc.co.uk/1/hi/uk/7581540.stm

A computer containing a million bank customers' personal data has reportedly been sold on an internet auction site.
The Daily Mail says an ex-worker for archiving firm Graphic Data sold it for £35 on eBay without removing sensitive information from the hard drive.
The Royal Bank of Scotland (RBS) and its subsidiary, Natwest, have confirmed their customers' details were involved.
RBS said Graphic Data had told it the PC had apparently been "inappropriately sold on via a third party".
It said historical information relating to credit card applications for their bank and others had been on the machine.
The information is said to include account details and in some cases customers' signatures, mobile phone numbers and mothers' maiden names.
It is thought the problem came to light when the person who bought the computer noticed and raised the alarm.
A spokesman for eBay said they had not been contacted by the Daily Mail and were currently looking into what had happened.
"Clearly such details should never have been included in the hard drive of the computer offered for sale on eBay. We fully expect Mr Chapman to hand it back to Graphic Data as soon as possible. We will of course work with Graphic Data to establish how it came to be available for sale on our site."
RBS and Natwest - two of the three businesses involved - said they are taking the issue very seriously and are working to resolve it "as a matter of urgency."
Banks have an obligation under the Data Protection Act to keep all personal information secure.
Last year the Financial Services Authority fined the Nationwide Building Society £980,000 for a security breach, after a lap top containing customer data was stolen from an employee's home

[Cornflower Blue]

The mind boggles!!

This is one of many cases of lost personal data that's happened in the UK in recent months - luckily in this case the guy who bought the computer reported it. Goodness only knows what would have happened if all those details had fallen into unscrupulous hands ...

[~Fabulousity~]

[mooks]

Thing is it also contained details from American Express too, could even have been credit card numbers......

[Veelyn]

eBay doesn't care what goes on their site as long as they get their fee's.

[Jahpson]

Originally Posted by Veelyn

eBay doesn't care what goes on their site as long as they get their fee's.

you never lied!

[Juicy]

OMG!!!!!!!!! I'm a Natwest customer and i'm not happy!

[mooks]

^^^ My other half is too!

[annanas]

so am i

but the media really have blown this out of all proportion, you'd have thought that there was a seller knowingly selling people's bank details on eBay. it doesn't even seem like ebay can be blamed here, if the machine sold for £35 i can hardly imagine the description indicating what was on the hard drive. unless the seller stole the computer (which doesn't seem likely to me - surely a thief would be more inclined to use the information on it for financial gain than selling it for hardly anything), graphic data are to blame for not erasing the information before getting rid of the machine.

[mooks]

No one has blamed eBay. The blame lies solely in the hands of Graphic Data and the ex-employee who sold the laptop. I think this has been made a big deal of because it comes after what seems to be a plethora of these types of data loss/theft and this laptop contained information such as passwords which if in the wrong hands could have been worth thousands

[Cornflower Blue]

Imo, the Banks themselves should have got rid of all the data before sending off this computer server for disposable. All the information should have been wiped beforehand.

As soon as one passes this sort of information to someone else to dispose of, one loses control of it.

It doesn't inspire confidence does it?!

[msbird]

Great. I knew I was scared of the web for a reason.

[VuittonsLover]

mine was in that pile.. i found out.

[ShimmaPuff]

Originally Posted by Cornflower Blue

T...if all those details had fallen into unscrupulous hands ...

I think you have to assume that they did.

Whoever put the data from the bank onto this computer, or removed a computer containing that data from the bank could have copied it and distributed it to the entire population of Iceland before putting the computer on eBay.

Once the data is out of the bank's "custody," nobody can say what may or may not have happened to it, which unfortunately means that anyone who thinks that they might have been affected should waste no time in changing absolutely everything and notifying every credit card, every bank, every everything, of what happened.