March 17, 2010

The Information Commissioner’s Office (ICO) has found that the Royal London Mutual Insurance Society breached the Data Protection Act (DPA) after eight laptops, two of which contained the personal details of 2,135 people, were stolen from the company’s Edinburgh offices. The individuals affected were employees of various firms which had sought pension scheme illustrations.

The two laptops containing personal information were unencrypted but were password protected. An internal report established that the company was uncertain about the precise location of the laptops at any given time and that physical security measures were inadequate. The report also revealed that managers were not aware that personal information was stored on any of the laptops, which meant no additional precautions to control and secure the data had been taken.

Mick Gorrill, Head of Enforcement at the ICO, said: ”It is crucially important that portable devices such as laptops containing personal information are properly protected. It is particularly concerning that the organisation was unaware of the whereabouts of the laptops at any given time or what information they held. All staff members should be fully aware of the policies and procedures in place to safeguard personal information and should be appropriately trained.

Facebook users have been warned that a “who viewed my profile” application is indeed a scam and does not genuinely show you who has looked at your profile at all.

Rik Ferguson, a senior security consultant at Trend Micro, warns he has already identified 25 different copies of the same rogue app but using different monikers such as peeppeep-pro, profile-check-online and stalk-my-profile.

Some of the Facebook Applications even offer a photo montage of the aleged visitors to your profile – these are fake and it simply randomly selects a group of your known friends and shows them in the image.

“The app itself is designed to look convincing enough, but none of the many ‘Continue’ buttons it offers will activate some under-the-counter profile checking functionality – they will just push you into another Facebook app earning the scammer advertising revenue in the process,” Ferguson explains in a blog post containing screenshots illustrating the scam, which resurfaced over the weekend. “There is no officially sanctioned Facebook functionality that will allow you to view who has been checking your profile.”

As always, TheRegister has a full report here: http://www.theregister.co.uk/2010/03/15/facebook_profile_stalk_scam/

At Consider IT, we want all our clients, customers and readers of our blog to remember not to install Applications you don’t trust. If something looks suspicious, then chances are it’s a scam. Err on the side of caution and ask yourself if you really want this unknown Application on your Facebook profile.

At the time of posting, Facebook have taken action to remove the offending Applications from their services.