Hacker tells York City Council it's been breached

The Council was contacted by a mysterious third-party claiming to have accessed 6,000 users' data from One Plant York App

Data on screen, viewed by shadowy hacker

A mysterious hacker contacted York City Council to say that they had breached the security on its mobile app, potentially affecting some 6,000 residents.

The unknown third-party told the council they had found a way to access personal data, including phone numbers, encrypted passwords and addresses, of residents who use the One Planet York app.

Advertisement - Article continues below

The app enables users to check their bin collection dates, check whether packaging is recyclable and find the location of recycling points. A council spokesman said that 5,994 records are contained in the app and could have been breached.

The council has taken the claims seriously, reporting the incident to the North Yorkshire Police and have taken the app down.

It has also contacted users by sending out letters, seen by The York Press. The letters state that the council does not know what the hacker is using the data for.

The letter says: "We value your privacy and deeply regret this incident occurred. We have conducted a thorough review of the One Planet York app, we have deleted all links with the app and as a result, will no longer support it going forward."We have deleted it from our website and asked for it to be removed from the app stores and ask that you now delete it from your device. We cannot say for certain what the third party responsible has done with the data."

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

The letter added that the hackers did not request anything in return for the personal data, which the council initially thought suggested an ethical hacker or "someone who looks for data vulnerabilities in the public interest".

"On November 1, 2018, a third party contacted the council and told us they had found a way to access personal data of those people who use the One Planet York app," said Ian Floyd, deputy chief executive at the council. "The data accessed included personal information such as names, addresses, postcodes, email addresses and telephone numbers together with encrypted passwords."To our knowledge, the data accessed did not include any further sensitive information. In addition, the One Planet York is isolated from other council systems and therefore unable to access other personal data."

Advertisement

Recommended

Visit/security/cyber-security/355185/165-million-britons-experienced-a-cyber-crime-in-the-past-year
cyber security

Report: 16.5 million Britons fell victim to cyber crime in the past year

1 Apr 2020
Visit/cloud/amazon-web-services-aws/355183/aws-launches-amazon-detective
Amazon Web Services (AWS)

AWS launches Amazon Detective for investigating security incidents

1 Apr 2020
Visit/security/privacy/355182/government-to-launch-coronavirus-contact-tracking-app
privacy

UK government to launch coronavirus 'contact tracking' app

1 Apr 2020
Visit/software/video-conferencing/355180/zoom-does-not-use-end-to-end-encrypted
video conferencing

Zoom admits meetings don't use end-to-end encryption

1 Apr 2020

Most Popular

Visit/security/cyber-security/355200/spacex-bans-the-use-of-zoom
cyber security

Elon Musk's SpaceX bans Zoom over security fears

2 Apr 2020
Visit/development/application-programming-interface-api/355192/apple-buys-dark-sky-weather-app-and-leaves
application programming interface (API)

Apple buys Dark Sky weather app and leaves Android users in the cold

1 Apr 2020
Visit/data-insights/data-management/355170/oracle-cloud-courses-are-free-during-coronavirus-lockdown
data management

Oracle cloud courses are free during coronavirus lockdown

31 Mar 2020