Name and surname, PESEL number and name of father and mother. This data, attached to the land and mortgage register numbers of all plots in Białystok, was available to each Internet user for five hours. All because – according to the city's statement – the employee's carelessness when updating information on the website.
The Białystok municipality informed in the Public Information Bulletin about a breach of personal data protection. It involved an employee of the IT Services Center publishing the land and mortgage register numbers of all plots located within Białystok on the city map website.
“The breach was caused by an employee's carelessness when updating information on the website,” the statement reads.
For five hours, each Internet user had access to land and mortgage register numbers (illustrative photo) Shutterstock
They found out after five hours
The incident was detected five hours after the data was uploaded. Access has been blocked. This is important because the owners' personal data are linked to the land and mortgage register numbers – name and surname, PESEL number and father's and mother's name.
And as the statement says, knowledge of the PESEL number may be used by third parties to obtain loans from non-bank institutions.
During this time, 35 people visited the website
“Nevertheless, it is unlikely that third parties would learn the number of the land and mortgage register in which you are listed, because at the time when the data was disclosed, i.e. within 5 hours, 35 people accessed the website with the map of Białystok (learning the land and mortgage register number required going into details of the plot),” we read in the statement.
Anyone who is concerned that their data may be used, for example, to obtain a loan, can use the SMS and e-mail notification service about an attempt to take out a loan or sign a loan agreement, provided by the Credit Information Bureau.
They changed the way they update the website
To prevent such cases from occurring again, the files used to update the website have been modified so that they do not contain land and mortgage register numbers.
The breach was reported to the President of the Personal Data Protection Office.
Main photo source: Shutterstock