NPC Issuance Wiki

NPC BN 18-006: In Re: Business World Inc.

Issued Resolution

Decision Text

IN RE: BUSINESS WORLD, INC.

Before the Commission is the Full Breach Report dated 15 August 2022 submitted by Business World, Inc. (Business World) in compliance with the directive of the Commission in the Order dated 30 June 2022.1

Facts

Business World submitted its Initial Report dated 12 January 2018 informing the Commission that on 09 January 2018, it found a Facebook post of the group “Cyber-Chaos team” entitled “BusinessWorld database dump by Cyberchaos”.2 The Cyber-Chaos team claimed that it “played with [sic] online security” of Business World’s online resource, www.bworldonline.com.[^3]

According to Business World, it found that the list in the “data dump” included email addresses with the extension, “@bworldonline.com”, and email addresses associated with other companies.3

Upon Business World’s further investigation, it found that its new WordPress Content Management System (CMS) may have been compromised, including the personal details of thirty (30) of its employees.4 Business World reported that the compromised personal details were the employees’ username, password, email address, first and last names, and administrative identification number.5

Business World also reported the following initial remediation steps to address the incident:6

  1. We contacted the Paste Bin site (where the relevant data was ‘dumped’) and, pursuant to our request, the lists that contain the personal data of the data subjects affected by this incident were taken down;

  2. We initiated contacting the group Cyber-Chaos team and requested that they take down their post on the subject ‘data dump’. At the same time, we submitted a report to Facebook requesting that the relevant post on the subject ‘data dump’ be removed/taken down. To date, we are awaiting the response of Facebook to our take-down request;

  3. We changed the root passwords and other related access rights/tools to the servers/systems that cater to our online resource/portal;

  4. We are currently reviewing our online resource/portal to check whether there are other data ‘missing’, and/or have other ‘malicious content’;

  5. We are currently crafting and implementing ‘heightened security measures’ on our servers and systems; and

  6. Our breach management and response team already reached out to the affected data subjects concerning this incident.

The Commission, through its Complaints and Investigation Division (CID), issued an Order dated 30 June 2022 directing Business World to submit its Full Breach Report within fifteen (15) days from receipt of the Order.7

On 29 July 2022, Business World requested an extension to submit its Full Breach Report until 14 August 2022.8 It claimed that since the incident, there were manpower changes in the company and that the employee who reported the incident to the Commission is no longer connected with the company.9

On 01 August 2022, the CID resolved to grant Business World’s request and directed it to submit the Full Breach Report within fifteen (15) days or until 15 August 2022.10

On 15 August 2022, Business World submitted its Full Breach Report.11 It reported that on 08 January 2018 it received an email about the incident from “an affected user outside of Business World,” who claimed that only her email address was exposed due to the breach.12

Upon investigation, Business World discovered that the WordPress version it was using “became the entry point of the hackers to conduct a Structured Query Language (SQL) Injection.”13 Thereafter, the Cyber-Chaos team reportedly posted the “data dump” on pastebin.com.14

Further, Business World reported that the incident occurred when it was migrating its database from the old BusinessWorld website to the new WordPress-based site.15

Business World informed that the incident affected thirty (30) employees and one thousand four hundred seventy-five (1,475) individuals outside Business World.16 It identified that as to the affected employees, the data exposed included the employees’ username and password for the old website, their email address with the extension “@bworldonline.com”, and the employees’ first and last name.17 As to the affected individuals outside Business World, their email addresses were exposed.18

With regard to the measures it took to minimize harm or mitigate the impact of the breach, Business World reported the following:19

i. We have built our own WordPress site that is no longer dependent on 7th Media’s customizations, enabling us to set updates to automatic, helping ensure that we are protected from exploits discovered of the said CMS

ii. Usernames and passwords were randomly generated so that anyone trying to do a brute force attack will have a very difficult time

iii. Passwords of users are reset every month

iv. The URL of the login screen is changed every month

v. The login screen has been geo-blocked and can only be accessed by Philippine IP addresses

vi. We have changed hosting services to Conversant Content Delivery Network (CDN) and Web Application Firewall (WAF)…we have not been hacked since.

vii. We have installed WordPress plugins such as Succuri Security and Blackhole for Bad Bots as additional layers of protection for our website.

viii. Plugins are updated every Friday

ix. The WordPress Database is cleaned and optimized every Friday

x. The old database that was compromised has been taken offline immediately after the incident has been discovered

xi. Server credentials are changed every month.

xii. No users from outside BusinessWorld are registered in the WordPress CMS.

According to Business World, it informed affected employees personally and sent notification letters to affected non-employees about the incident and the measures that must be done.20 As proof of its notification to the affected individuals outside the company, Business World submitted a copy of the notification letter dated 17 January 2018.21

Issue

Whether Business World sufficiently complied with the Order dated 30 June 2022.

Discussion

The Commission resolves to close the case upon finding that Business World sufficiently complied with the Order dated 30 June 2022.

Business World sufficiently notified the affected data subjects and implemented measures to prevent the recurrence of the breach.

The notification letter dated 17 January 2018 that Business World sent to its affected individuals included the information required under NPC Circular 16-03 (Personal Data Breach Management). Section 18 (C) of NPC Circular 16-03 provides:

Section 18. Notification of Data Subjects. The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

…

C. Content of Notification. The notification shall include, but not be limited to:

  1. nature of the breach;

  2. personal data possibly involved;

  3. measures taken to address the breach;

  4. measures taken to reduce the harm or negative consequences of the breach;

  5. representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and

  6. any assistance to be provided to the affected data subjects.22

Where it is not possible to provide the foregoing information all at the same time, they may be provided in phases without undue delay.

In the letter-notification dated 17 January 2018, Business World informed the affected data subjects of the nature of the breach by reporting that the hacker group Cyber-Chaos team claimed that it gained access to Business World’s data and posted the data online.23 It further identified that the incident involved the email addresses of Business World’s subscribers.24

Business World assured the affected data subjects that the website, where the email addresses were posted, has been immediately taken down.25 It also informed the affected data subjects that it has taken action “to further strengthen the security of [its] system” and advised them to regularly change their passwords.26

The letter dated 17 January 2018 also specified Business World’s email address, where affected data subjects can ask for further information regarding the breach.27

Given the foregoing, the Commission finds that Business World has sufficiently notified the affected data subjects of the breach.

In addition, the Commission notes the remedial measures taken by Business World. Business World built its own WordPress site that enables automatic updates and it implemented additional layers of security on its website for protection against vulnerabilities it has identified.28 It also took down the old database that was compromised immediately after the discovery of the incident.29

Business World’s random generation of usernames and passwords and the monthly resetting of the passwords provide more security and protection to the personal data of the data subjects.30 These measures are sufficient to address the breach and prevent the recurrence of the incident.

Dispositive Portion

WHEREFORE, premises considered, the Commission resolves that NPC BN 18-006 – In Re: Business World, Inc. is hereby CLOSED.

SO ORDERED.

City of Pasay, Philippines.

10 November 2022.

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

I CONCUR:

JOHN HENRY D. NAGA

Privacy Commissioner

Copy furnished:

ASD Data Protection Officer Business World, Inc.

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Full Breach Report, 15 August 2022, in In Re: Business World, Inc., NPC BN 18-006 (NPC 2022). ↩

  2. Initial Report, 12 January 2018, at 1, in In Re: Business World, Inc., NPC BN 18-006 (NPC 2022). ↩

  3. Id. ↩

  4. Id. at 1-2. ↩

  5. Id. at 2. ↩

  6. Id. at 2. ↩

  7. Order (To submit Full Breach Report), 30 June 2022, at 1, in In Re: Business World, Inc., NPC BN 18-006 (NPC 2022). ↩

  8. Email from JDN, Business World, Inc., to Complaints and Investigation Division, National Privacy Commission (29 July 2022). ↩

  9. Id. ↩

  10. Resolution of Motion for Extension, 01 August 2022, at 1, in In Re: Business World, Inc., NPC BN 18-006 (NPC 2022). ↩

  11. Email from ASD, Business World, Inc., to Complaints and Investigation Division, National Privacy Commission (15 August 2022). ↩

  12. Full Breach Report, 15 August 2022, at 1, in In Re: Business World, Inc., NPC BN 18-006 (NPC 2022). ↩

  13. Id. ↩

  14. Id. ↩

  15. Id. ↩

  16. Id. at 2. ↩

  17. Id. ↩

  18. Full Breach Report, 15 August 2022, at 2, in In Re: Business World, Inc., NPC BN 18-006 (NPC 2022). ↩

  19. Id. at 2-3. ↩

  20. Id. at 3. ↩

  21. Id. Annex. ↩

  22. National Privacy Commission, Personal Data Breach Management, Circular No. 3, Series of 2016 (NPC Circ. No. 16-03), §18 (C) (15 December 2016). ↩

  23. Full Breach Report, 15 August 2022, Annex, in In Re: Business World, Inc., NPC BN 18-006 (NPC 2022). ↩

  24. Id. ↩

  25. Id. ↩

  26. Id. ↩

  27. Id. ↩

  28. Id. at 2. ↩

  29. Full Breach Report, 15 August 2022, at 3, in In Re: Business World, Inc., NPC BN 18-006 (NPC 2022). ↩

  30. Id. ↩

Backlinks

  • No backlinks found