Incident: Data Breach at PageUp Software Impacts Job Applicants and Companies

Published Date: 2018-06-07

Postmortem Analysis
Timeline 1. The software failure incident involving PageUp occurred in May 2018 [72570].
System The system that failed in the software failure incident reported in Article 72570 is: 1. PageUp's IT infrastructure [72570]
Responsible Organization 1. The software failure incident was caused by a hack, with criminals gaining access to PageUp's systems, as reported by the Australian Cyber Security Centre and PageUp's CEO [72570].
Impacted Organization 1. Coles, Target, Kmart, Officeworks [72570] 2. NAB [72570] 3. Telstra [72570] 4. Commonwealth Bank [72570] 5. Lindt [72570] 6. Aldi [72570] 7. Linfox [72570] 8. Reserve Bank of Australia [72570] 9. Australia Post [72570] 10. Medibank [72570] 11. ABC [72570] 12. Australian Red Cross [72570] 13. University of Tasmania [72570] 14. AGL [72570] 15. Jetstar [72570]
Software Causes 1. The software failure incident was caused by a hack where PageUp, a multinational software provider used for recruitment management, was hacked, leading to potential compromise of thousands of job applicants' personal details [72570].
Non-software Causes 1. Lack of adequate cybersecurity measures in place to prevent hacking attempts [72570] 2. Failure to detect unusual activity in the IT infrastructure promptly [72570] 3. Insufficient data protection protocols for highly sensitive personal information [72570]
Impacts 1. Personal details of thousands of job applicants may have been compromised, including birth dates, passport details, tax file numbers, and bank accounts [72570]. 2. Several large corporates and government agencies suspended their recruitment sites as they awaited answers on the extent of the security incident and possible data breach [72570]. 3. Companies using PageUp's software, such as Wesfarmers, NAB, Telstra, Commonwealth Bank, Lindt, Aldi, Linfox, Reserve Bank of Australia, Australia Post, Medibank, ABC, Australian Red Cross, University of Tasmania, AGL, and Jetstar, were affected by the breach [72570]. 4. The breach involved malicious code executed within PageUp's systems, potentially giving criminals access to sensitive documentation [72570]. 5. The incident highlighted the importance of companies and service providers taking adequate steps to protect the personal information of employees and job applicants to prevent such security breaches [72570].
Preventions 1. Implementing robust cybersecurity measures such as regular security audits, penetration testing, and intrusion detection systems could have potentially prevented the hack on PageUp's software [72570]. 2. Ensuring timely software updates and patches to address any known vulnerabilities could have helped in preventing unauthorized access to the system [72570]. 3. Conducting thorough background checks on third-party software providers like PageUp to ensure they adhere to strict security protocols and standards could have mitigated the risk of a security breach [72570]. 4. Educating employees and users on best practices for data security, including strong password policies, awareness of phishing attempts, and regular security training, could have enhanced overall system security [72570].
Fixes 1. Conducting a thorough investigation to determine the nature and extent of the security incident and data breach, as initiated by PageUp and the client companies [72570]. 2. Implementing enhanced security measures to prevent future breaches, such as strengthening IT infrastructure, monitoring for unusual activities, and enhancing data protection protocols [72570]. 3. Collaborating with cybersecurity authorities like the Australian Cyber Security Centre (ACSC) and engaging with relevant response teams to address the breach and mitigate its impact [72570]. 4. Advising all PageUp users to change their passwords as a precautionary measure to protect their accounts and personal information [72570].
References 1. PageUp company statement [72570] 2. Chief executive Karen Cariss [72570] 3. Companies affected by the breach (Wesfarmers, NAB, Telstra, Commonwealth Bank, Lindt, Aldi, Linfox, Reserve Bank of Australia, Australia Post, Medibank, ABC, Australian Red Cross, University of Tasmania, AGL, Jetstar) [72570] 4. Head of the Australian Cyber Security Centre (ACSC) Alastair MacGibbon [72570] 5. Principal solicitor of Centennial Lawyers, George Newhouse [72570]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: - The incident involving the hack of PageUp's software is a significant event that has affected multiple organizations, including Coles, NAB, Telstra, Commonwealth Bank, Lindt, Aldi, Linfox, Reserve Bank of Australia, Australia Post, Medibank, ABC, Australian Red Cross, University of Tasmania, AGL, and Jetstar [72570]. (b) The software failure incident having happened again at multiple_organization: - The incident involving the hack of PageUp's software has impacted several large companies and government agencies in Australia, all of which use PageUp for managing job applications. These organizations have suspended their recruitment sites as they await more information on the security breach [72570].
Phase (Design/Operation) design, operation (a) The software failure incident in this case was primarily due to a design-related issue. The incident occurred because PageUp, a multinational software provider used for recruitment management, was hacked, leading to a data breach compromising thousands of job applicants' personal details [72570]. The breach was a result of "unusual activity" noticed in PageUp's IT infrastructure, indicating a vulnerability in the system's design that allowed for unauthorized access and data compromise. (b) Additionally, the operation of the system played a role in the failure as well. Following the breach, several large corporates and government agencies suspended their recruitment sites that relied on PageUp's software, indicating that the operation of the system was impacted by the security incident [72570]. The need to suspend operations and investigate the extent of the breach highlights the operational impact of the software failure incident.
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident involving PageUp was due to a hack where malicious code was executed within PageUp's systems, leading to a data breach affecting thousands of job applicants [72570]. The unusual activity in PageUp's IT infrastructure on May 23 was an internal factor that contributed to the breach [72570]. (b) outside_system: The software failure incident was also influenced by external factors as criminals were able to gain access to PageUp's systems, indicating a breach from outside the system [72570]. Additionally, the involvement of the Australian Cyber Security Centre (ACSC) and other authorities highlights the external impact on the incident [72570].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in this case was due to non-human actions, specifically a hack. PageUp, a multinational software provider used for recruitment management, notified that it had been hacked, leading to potential compromise of thousands of job applicants' personal details [72570]. (b) Human actions were also involved in response to the incident. Companies like Coles suspended connections between their systems and PageUp's systems, changed passwords, and released emergency statements to their employees and candidates who had applied for jobs using PageUp's software [72570]. Additionally, the principal solicitor of Centennial Lawyers emphasized the duty of employers to keep personal information confidential and the importance of taking adequate steps to protect employees' information, highlighting the role of human actions in ensuring data security [72570].
Dimension (Hardware/Software) hardware (a) The software failure incident in Article 72570 occurred due to a hardware-related issue. The incident was a result of a hack on the multinational software provider, PageUp's IT infrastructure, leading to a data breach compromising thousands of job applicants' personal details [72570]. The breach involved malicious code executed within PageUp's systems, indicating a breach that originated in the hardware infrastructure rather than a software flaw [72570].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident in this case was malicious. The incident involved a hack on the PageUp software, where malicious code was executed inside PageUp's systems, potentially giving criminals access to sensitive personal information of job applicants from various large companies and government agencies [72570]. The breach was intentional and aimed at compromising the security of the system to access and misuse personal data for identity fraud or other malicious purposes.
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident related to the PageUp hack can be attributed to poor decisions made in terms of cybersecurity measures. The incident was a result of a security breach where malicious code was executed within PageUp's systems, leading to potential access by criminals to sensitive personal information of job applicants [72570]. Additionally, the failure to adequately protect the personal information of employees and job applicants highlights the consequences of poor decisions in ensuring data security and confidentiality [72570].
Capability (Incompetence/Accidental) accidental (a) The software failure incident in Article 72570 was not due to development incompetence but rather a hack. PageUp, a multinational software provider used by large companies for recruitment, notified that it had been hacked, leading to a data breach compromising thousands of job applicants' personal details [72570]. (b) The software failure incident in Article 72570 was accidental in the sense that the hack and data breach were not intentional actions by the company but rather a result of malicious activity in its IT infrastructure that was noticed on May 23. The company launched an investigation and notified relevant authorities to address the security incident [72570].
Duration temporary The software failure incident reported in the articles is temporary. The incident was caused by a hack on the PageUp software, leading to a data breach compromising thousands of job applicants' personal details. As a response to the breach, several large corporates and government agencies suspended their recruitment sites and took measures to mitigate the impact of the security incident [72570]. The incident is not described as a permanent failure but rather a breach that occurred due to specific circumstances introduced by the hack.
Behaviour crash, omission, value, other (a) crash: The software failure incident in this case can be categorized as a crash. PageUp, the software provider, notified that it had been hacked, leading to a data breach compromising thousands of job applicants' personal details. As a result, several large corporates and government agencies suspended their recruitment sites as they awaited answers on the extent of the security incident and possible data breach [72570]. (b) omission: The incident also involves omission as the software failed to protect the personal information of job applicants, including birth dates, passport details, tax file numbers, and bank accounts. This omission to safeguard sensitive data led to the potential exposure of individuals to identity fraud [72570]. (c) timing: There is no specific mention of a timing-related failure in the articles provided. (d) value: The software failure incident can be linked to a value-related failure as the breach resulted in the system performing its intended functions incorrectly by allowing unauthorized access to highly personal information of job applicants and potentially exposing them to identity fraud [72570]. (e) byzantine: The incident does not exhibit characteristics of a byzantine failure. (f) other: The other behavior exhibited in this software failure incident is a security breach due to malicious code executed within PageUp's systems, leading to criminals potentially gaining access to sensitive documentation. This unauthorized access and breach of security protocols highlight the vulnerability of the system to external threats and the importance of robust cybersecurity measures [72570].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident involving PageUp, a multinational software provider, resulted in a data breach where thousands of job applicants' personal details may have been compromised. The information potentially exposed in the breach included birth dates, passport details, tax file numbers, and bank accounts [72570]. This indicates a significant impact on individuals' data and potentially their financial security.
Domain information, transportation, finance, health, government, other (a) The failed system in this incident was related to the industry of information. The software provided by PageUp was used by companies like Telstra, Wesfarmers, Linfox, the Reserve Bank, and the ABC to manage job applications online, indicating its role in the production and distribution of information [72570]. (h) Additionally, the incident involved financial information being potentially compromised, as job applications could include details such as tax file numbers and bank accounts, highlighting the connection to the finance industry [72570]. (l) Furthermore, the government sector was impacted as well, with agencies like the Reserve Bank of Australia, Australian Red Cross, and the University of Tasmania using PageUp's software for recruitment purposes [72570]. (m) The incident also had implications for other industries such as retail (Wesfarmers: Coles, Target, Kmart, Officeworks), telecommunications (Telstra), banking (Commonwealth Bank, NAB), healthcare (Medibank), postal services (Australia Post), and transportation (Jetstar, Linfox) [72570].

Sources

Back to List