Cyber expert says security breach should be a wakeup call

Cybersecurity expert Nrupesh Soni says the Telecom Namibia (TN) security breach should be a wakeup call for people to understand the importance of not giving data away freely.

Speaking to Desert FM on Monday morning, Soni urged citizens to not hand out identification documents to just anyone.

He said going forward, TN will have to take action to ensure and guarantee to people that data is encrypted to regain trust.

“It shouldn’t even be accessible by their own employees without proper access systems in place, like most other countries do. But here, it seemed like it was on a server where everybody, all employees had access,” Soni said.

This comes as TN experienced a security breach over the weekend that saw the personal information of over 619 000 TN clients being leaked online.

The over 626.3-gigabytes of confidential information leaked on Saturday includes data from the Office of the President, medical records, airlines, regional and town councils, universities, mining companies, car dealerships and restaurants.

The government has launched an investigation into the matter. Soni said in the wrong hands, the information leaked can be misused to create new bank accounts and falsify documents.

He said given the time frame given to TN by the extortionist, they could have called in help from outside.

“I can’t say for sure that they could have prevented the situation, but when something like this happens and they had two weeks to work on it, they could have called in outside help,” Soni said.

He said it is understandable that they did not want to pay the ransom or negotiate about it, but knowing that so much data was at risk, and still denying it, is where he believes people drew the line.

Soni urged citizens to be more vigilant and not to click on any link forwarded to them via email or text. On the issue of policies passed to Cabinet by the Ministry of Information and Communication Technology, Soni said the enactment of the Data Protection Act will help in holding organisations accountable when it comes to keeping private data safe.

“They will have to use it responsibly because otherwise there’ll be an impact on them. There’ll be fines and other punishments in place.” he said.