{"id":34790,"date":"2020-05-04T15:37:08","date_gmt":"2020-05-04T15:37:08","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/31174\/Australian-Home-Affairs-Breach-Leaks-Details-On-700-000-Migrants.html"},"modified":"2020-05-04T15:37:08","modified_gmt":"2020-05-04T15:37:08","slug":"australian-home-affairs-breach-leaks-details-on-700000-migrants","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/australian-home-affairs-breach-leaks-details-on-700000-migrants\/","title":{"rendered":"Australian Home Affairs Breach Leaks Details On 700,000 Migrants"},"content":{"rendered":"

Privacy<\/a> experts have blasted the home affairs department for a data breach revealing the personal details of 774,000 migrants and people aspiring to migrate to Australia, including partial names and the outcome of applications.<\/p>\n

At a time the federal government is asking Australians to trust the security of data collected by its Covid-Safe contact tracing app<\/a>, privacy experts are appalled by the breach, which they say is just the latest in a long line of cybersecurity blunders.<\/p>\n

The department\u2019s SkillsSelect<\/a> platform, hosted by the employment department, invites skilled workers and business people to express an interest in migrating to Australia.<\/p>\n

Expressions of interest are stored for two years and displayed on a publicly available app<\/a>, advertised on the home affairs website, allowing them to receive invitations for skilled work visas.<\/p>\n

With just two clicks, users of the app can view a range of fields including the applicants\u2019 \u201cADUserID\u201d, a unique identifier composed of partial name information and numbers.<\/p>\n

\"Screenshot<\/div>\n

Screenshot from SkillSelect taken on 30 April, 2020 showing ADUserID information.<\/p>\n

Searches by Guardian Australia revealed the public database contained 774,326 unique ADUserIDs and 189,426 completed expressions of interest, searchable as far back as 2014.<\/p>\n

Other information available includes the applicants\u2019 birth country, age, qualifications, marital status and the outcome of the applications.<\/p>\n

By applying multiple filters, a user could narrow down an expression of interest to a single entry, revealing the other details of the applicant.<\/p>\n

\"Screenshot<\/div>\n

Screenshot from SkillSelect app taken on 30 April, 2020 showing ADUserID information.<\/p>\n

Monique Mann, an Australian Privacy Foundation board member, told Guardian Australia the breach was \u201cvery serious \u2026 especially at a time where the Australian government is expecting trust\u201d.<\/p>\n

Mann said the information was \u201ccomprehensive\u201d and it was \u201cabsolutely ludicrous\u201d after academic work by Vanessa Teague and others on the re-identification of health data<\/a> that the department would make available \u201cinformation that doesn\u2019t even need to be re-identified, it is contractions of people\u2019s names\u201d.<\/p>\n

Mann accused the federal government of a \u201cconsistently poor track record that shows that we cannot trust them with our personal information\u201d \u2013 citing \u201cblunders\u201d including the My Health Record<\/a>, robodebt and 2016 census.<\/p>\n

Teague, privacy academic and chief executive of Thinking Cybersecurity, said the presence of ADUserIDs \u201clooks like a stuff-up\u201d.<\/p>\n