Order Text
IN RE: VULNERABILITY ASSESSMENT OF JOLLIBEEDELIVERY.COM CID BN No. 17-043
x----------------------------------------------------x
ORDER
On 05 November 2019, the Commission issued an Order with the following dispositive portion:
WHEREFORE, all premises considered, this Commission resolves to:
- GRANT the lifting of the suspension on the operations of jollibeedelivery.com;
- ORDER JFC to file a Monthly Progress Report for three (3) months following the launch of the new jollibeedelivery.com website;
- ORDER JFC to conduct regular audit and monitoring to ensure the implementation of security measures and the protection of processing of personal information, without need of furnishing the Commission.
The reported breach concerns the alleged unauthorized access to the customer database of jollibeedelivery.com, the delivery website for Jollibee Foods Corporation (JFC). In the course of its investigation, the Complaints and Investigation Division (CID) identified the incident as a “proof of concept” performed by members of Secuna Software Technologies, a domestic cybersecurity firm. A proof-of-concept in the world of cybersecurity is a type of media, either from text, document, image, or video, that demonstrates how to compromise or exploit a certain system. The test-hack of the website was initiated by a certain marketing PR team representative of JFC, who made representations with Secuna despite them not being officially engaged by the corporation.
The CID confirmed, through a vulnerability assessment, that the website jollibeedelivery.com and its subdomains jfc.com.ph were vulnerable to web defacement or cross-site scripting, cross-site request forgery, and clickjacking, to name a few. The team noted as well that the subdomains did not have SSL encryption and that there was a vulnerable link where data scraping was possible. They confirmed that it was possible, with the use of certain tools, to access personal information from accounts without the required username and password.
As a response to these findings, JFC voluntarily took down the delivery website of Jollibee, as well as those of its other brands such as Chowking, Greenwich, Mang Inasal, and Red Ribbon.
Following these events, the Legal and Enforcement Office issued an Order dated 4 May 2018, where JFC was ordered to:
-
SUSPEND forthwith the operations of jollibeedelivery.com and all other data processing open to the public through the internet and restrict external access to their networks, for an indefinite time until the site’s identified vulnerabilities are addressed, as validated by a duly certified penetration testing methodology;
-
SUBMIT a security plan to be implemented in rehabilitating said system to ensure the integrity and retention of the database and its content within ten (10) calendar days upon receipt of the Order;
-
EMPLOY Privacy by Design in the reengineering of JFC Group data infrastructure;
-
CONDUCT a new Privacy Impact Assessment, considering the vulnerabilities exposed in the Commission’s penetration tests and in subsequent penetration tests ordered;
-
FILE a Monthly Progress Report on this matter until the issues raised in this Order are resolved.
Since this Order, JFC submitted two (2) Monthly Progress Reports dated 17 May 2018 and 01 July 2018. After the submission of these reports, an evaluation was made by the CID on the system, and the same vulnerabilities were still exposed. The Commission also notes that, as of this writing, no formal request has been made by JFC to lift the suspension of the subject website’s operation.
WHEREFORE, all premises considered, it is resolved that the operations of jollibeedelivery.com and all of JFC’s other data processing through the internet remain suspended, and that external access to their networks be restricted, until the identified deficiencies are addressed to the satisfaction of the Commission.
SO ORDERED.
City of Pasay, Philippines 06 August 2019.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
WE CONCUR:
IVY D. PATDU Deputy Privacy Commissioner
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
Copy furnished:
MRG Data Protection Officer
ENFORCEMENT DIVISION Legal and Enforcement Office
GENERAL RECORDS UNIT