First National real estate Burleigh Waters and Palm Beach fall victim to data breach

Two Gold Coast real estate branches have fallen victim to an alleged national data breach with private information including names, photos, addresses and phone numbers leaking online.

TWO Gold Coast real estate branches have fallen victim to an alleged national data breach causing job applications to be leaked online.

First National Real Estate branches at Palm Beach and Burleigh Waters have fallen victim to the reported breach, which involved cover letters and resume’s containing personal information such as names, photos, addresses, phone numbers, job history and dates of birth being published.

The leak was discovered by UK-based privacy advocate Gareth Llewellyn who revealed the details of the breach on his personal twitter account yesterday.

Hi @firstnational it seems that CV/covering letters sent to you have been inadvertently published.

Full names, addresses, phone numbers, dates of birth etc.

Can someone please DM me so this can be resolved quickly.

Also, please notify @OAICgov of the breach.

Thanks pic.twitter.com/VN9l0QXsY3

— Gareth (@NetworkString) January 4, 2019

Mr Llewellyn estimated the personal information of around 2000 applicants was leaked in the breach, which targeted unsecured cloud files stored by hosting website Amazon.

The files can be accessed through an online website which allows the public to search a database of potentially sensitive files stored by Amazon.

It is understood 12 of First National’s 400 offices across Australia and New Zealand were affected by the breach.

First National communications manager Stewart Bunn told The Gold Coast Bulletin he is aware of the breach with the documents and data now secured.

Mr Bunn said a full investigation is currently underway, with Sydney-based online recruiting company Sales Inventory Profile believed to be the source of the breach.

He Sales Inventory Profile had no direct affiliation with First National, however independent branches are able to use the services of recruiting companies as part of their hiring process.

SUBSCRIBE TO THE GOLD COAST BULLETIN FOR JUST $5 A MONTH FOR THE FIRST THREE MONTHS

Some examples of the files leaked in an alleged data breach of a website hosted by a recruiting company for First National real estate at Palm Beach and Burleigh Waters. Picture: Supplied.

“We have no direct relationship with this company and none of our private files have been breached,” Mr Bunn said.

“It appears that some documentation including CV’s and cover letters have been inadvertently exposed through a cloud service used by Sales Inventory Profile.

“First National real estate businesses are independent and there is no formal hiring process. The choice is that of the principal as to what agency they wish to use.”

Mr Bunn said Office if the Australian Information Commissioner has been informed of the breach and all those affected have been informed.

Sales Inventory Profile owner Maya Saric said she was made aware of the alleged breach yesterday but is still investigating where it came from.

Another letter leaked online Picture: Supplied.

Ms Saric said the privacy breach may be the result of a fundamental error by website host Amazon.

“It is not apparent whether it came through our website. There is no evidence of a breach our end,” she said.

“As far as we know it is still being investigated. We have changed the security processes so we know it is now secure.

“We are still working it out and we need to make sure it is secure so it doesn’t happen again.”