Hi I'm having a great day. All my personal information was just stolen from the Western Australian Government. Whoa! Thank you very much to the Perth men who are a Western Australian government owned a company that meant Australian legal tender coins. They also sell gold and silver bullion and do bullion trading and stuff like that.

And I have an account with them. And I was one of the 32 hundred people who were caught up in a privacy personal information data breach from the Perth Mint Oh, not specifically from them, but from a third-party company that they used to hold the data. Well done. Now they actually alerted customers as they're required to under law about any data breaches like this back on the 8th of September.

It actually happened a couple of days before that, but they're investigating and at the time they only thought that 13 customers were affected. But they will keep us updated And as it turns out, the latest release today, once again, they emailed a customer's effectively of the 3200 online customers. As previously advised, ongoing forensic investigations continue. As we were made aware of this development over the weekend, we have moved quickly to contact the affected depository online customers in order to protect their interests.

Well, they did contact me quickly. While we were extremely disappointed, we have again assured our customers that their investments are unaffected and remain safe and secure. Yeah, no worries about my our stuff at the Perth Mint But what about my personal identity? Ever heard of identity theft? One thing you won't find in here. Other words, Identity Theft? No, all they care about is I Know they didn't breach our system so your money with us is safe.

No worries. Our dedicated customer support team has been working extended hours to provide our customers with advice and to answer any inquiries they may have. I can vouch for that and I was actually um, emailing talking to last night and they responded and answered my questions as best they could. but we'll get into that in a minute.

Mr.. Hayes who's the CEO confirmed the data breach occurred on the systems of a third party technology provider. However, he again assured customers that there is no evidence to suggest the % Perth Mints own internal systems have been compromised in any way. Well, if you got such good systems, why didn't you keep all your data there? We launched a forensic investigation when the data breach was identified.

Now, we have worked closely with our third-party provider and a range of cybercrime experts. During the ongoing inquiry, he said we are continuing to work with the third party provider to understand how this breach has occurred and will continue to work with the authorities, including the Australian Federal Police I Can assure our customers there is no threat to any account holdings at the Perth Mint and none of our data systems have been breached. Well, you would have been confident last week, wouldn't you or a couple of weeks back before this happened. That odd.

No. nobody can touch your information here and got it through a third party good. Anya So let's hear from the CEO Dick Hayes He looks like a deer in headlights. Take it away Dick, This meant just over a week ago I Alerted you to a data breach which impacted 13 depository on only 13.

We immediately commenced a forensic investigation to determine how this breach occurred and committed to you to provide any further information should it arise. As a result of our investigation, we now know that the personal data of 3200 deposit 3200 now Ares has been taken from information held by a third party provider. I Want to reassure all of you that despite this breach, all of your investments remain safe and secure and there is no threat to your account holdings. As you can imagine, enquiries of this sort are complex and very time-consuming We have committed substantial resources to the forensic investigation and continue to work with the authorities, including the Australian Federal Police and cybercrime experts.

Experian Edition I Sincerely regret any concern caused by this incident and can assure you we are doing everything we can to determine how this occurred and to support our customers. Thank you Thanks Dick! I Also did a video back when they thought they only had 13 customers affected here and look what they did. Comments are disabled for this video. Don't want people talking about this do you know? But they have actually enabled comments on the new one.

So go ahead and comment. I'll provide a link down below. I'll be there Now here's the email that they actually sent to customers and this is important because this is their disclosure and their advice to customers. Our forensic investigations now confirm that your personal information was also compromised by the breach that occurred in systems belonging to a third party technology provider.

As a result, the personal information that was stored in relation to your account has been accessed by an unauthorized person. They don't say that you know that they don't say external hack or anything like that. There's no details provided at all, so it may have been somebody who worked at this third-party provider or something like that. We just don't know.

This information includes the numbers of your bank account, your passport and/or driver's license. However, no scanned copies of any documents you have provided have been accessed illegally. Oh, just the people who can legally access at which customers never gave them permission to do because you think that no, you know it's a government organization they would like secure the data properly themselves. Noop.

As a precaution, we recommend that you contact your bank and advise them of this data breach so they can advise you of any steps that should be taken. If you have any concerns over the use of your driver's license and/or passport numbers, we recommend that you contact the relevant authorities and also seek their advice. The information illegally access was taken from an old 2016 database. so if you have updated your personal information out for this date, your updated information remains secure.

So it was stolen from an old database. So who is this third party provider? Is it some cloud storage or backup company or something like that that had access to an old database? Was that database encrypted or did they break the encryption? or was it just a plain text SQL thing or something? I was just all higgledy-piggledy with the backups and well, somebody found an old database lying around somewhere. We sincerely regret any concerns caused by this incident. We're gonna reassure you that investments are unaffected, blah blah and a safe and guaranteed by the Western Australian government.

Your money might be guaranteed by the government, but your privacy and your information security. And sure they don't seem to give it to us, long as your money's safe, she'll be right. No, I cares about identity theft and that's the thing You'll never find them out of the word identity theft. And the interesting thing is they only mentioned bank account, passport, and/or driver's license numbers.

They don't tell you that everything was stolen, absolutely everything. and this is probably illegal because they're not fully disclosing if you actually go in here. Notifiable data breaches scheme under privacy under Australian Privacy law How to notify people? It specifically says the kinds of information concern they didn't tell you everything. How do I know this? Because I Emailed them last night and they replied and said yep, they stole everything.

Every bit of personal information you entered into that website Hi Mr. Jones Yes, Unfortunately, all data fields on your account with the exception of your login password were included in the breach. This includes your address, phone number, email address, a reference number, and expiry data. You're supplied identity documents and banking details and they don't and there's actually more stuff in there which they don't tell you about as well.

So even though I asked, they still didn't disclose every bit of information that was stolen. We appreciate your concerns, but liked again Once again, reassure you that the Performance Systems and your online depository account remain secure and unaffected. We remain confident in the existing processes we have in place within the Perth Mint provide a high level of security without applying excessive burden of processes on our customers. Given the ever-changing nature of cyberattacks, we are constantly looking for ways to improve security for our counts and clients.

You have bet you are now that you got hacked decades. We do also use a third-party facility to store client personal data. Why? third-party data storage providers are often used throughout the financial services industry as well as other industries as their expertise and methods of protecting data are recognized to be the most stringent and up to date if the third party in question was selected after comprehensive risk assessment was undertaken and found to have world's best practice of cyber security protocols. Unfortunately, as evidenced by a number of data breaches occurring globally, such systems from time to time can be breached.

just an old database lying around somewhere probably what I'm 5 and a quarter inch floppy. For security and legal reasons, we do not publish the identity of the third-party data storage facility that we utilize, but we can assure you that they are one of the leaders in this field. Yeah, I Think we are very disappointed that this particular cyber attack occurred and we are very sorry for the concern that this may cause you. Unlike any other depository facilities, the middle and funds held in your account remain guaranteed by the government.

But once again, no mention of identity theft and there was not a full and complete disclosure here of what actually what data fields were actually stolen. And that's important when it comes to identity theft and the customers ability to be able to deal with that. They don't give you everything. so how is the customer supposed to know what steps they're going to take? So when I question them again on why they didn't disclose all of the data fields that were actually stolen, this is their response.

Due to the ongoing criminal investigation, we have been provided with responses that have been currently deemed as acceptable for the time being. like as in yeah, you don't need to know the exact fields that was stolen I Sincerely do understand your concerns about identity theft because I mentioned that I hold I myself hold an account that was we in the affected group. The reason we didn't list each and every details the breech is simply that there were 3,200 accounts affected and to list the information against each account would have been a further disclosure of information that as you may imagine, we are seriously trying to control. you have the contact details of all the affected customers.

You could have emailed just those affected customers and told them as it seems you're required by Australian privacy law to detail each and every item that was stolen, each of personal identifiable item. Instead, the decision was made to release an email communication as soon as possible in their responder clients more specifically upon their response. Yes, you did. But then when I asked for specific things, you still didn't tell me what feel exactly what feels like to go into my account and actually look at all the stuff that I entered when I actually signed up for the thing to find out and there's probably more than that that's not showing up on the accounts field.

They do finally admit it. We are very aware of the effects of identity theft and are trying to assist clients as much as possible. If you believe there is anything, they were able to help you, please let me know and I will do what? I am able to thank you very much. They're very responsive and kind at the Perth mean I Must admit, they've been.

You know they are pretty good up to that point. and of course, a sadly predictable our response from the media here. in terms of this: Yes, they did report on it, but really, it's just regurgitating their blurb right. If there's just nothing, there's no questions being asked anything like that.

it's just all the same. it's all the same crap. they just re good st.. but he odd, doesn't he look smart? It's just all the same.

Like anyway. so I decided to ask them some questions. Some you know, real journalistic questions as you should. So these are the questions I sent to the people who were previously very responsive to me.

but I said right. I'm in journalist mode now. please answer these questions I Know you are not willing to name the third party company involved, but are you able to say the type of company that was involved eg. given that you said was a breach of a 2016 database Was it the backup data provider? A server host provider for example - Are you able to comment and why this third party was required to hold or access this information? 3 Are you discontinuing the use of this third-party service provider for was the personal information stolen encrypted? If not, why not? If yes, Was the encryption broken or otherwise circumvented, Or did the Feith have authorized access to the data as an employee of the third party company were depository customers deliberately targeted? Does the Perth Mint use third-party providers for other customers? If so, will the Perth Mint be re-evaluating their stance on using third-party providers for the handling of personal data in the future? Your prompt answer these questions would be appreciated, even if it is no comment.

Guess which option? they decided on Surprise Surprise. They fob me off to a third party ironically because I can't handle this in their house just like their privacy like Marketing Communications Crisis Manager company. So I Got this email back from the Director of Media Strategy at Cannon Purple Strategic Communications Hi Dave Thanks for getting in touch. Please see attach to media release Alton announcing details around the data breach and 3200 blah blah blah.

That's it. And it's the standard media release that's on the website. They wouldn't answer a single one of those genuine questions. Unbelievable.

I Just lift up the right, just sweep it under. It'll just pass it. You know, a couple of days it'll pass the news cycle crisis averted and it's just the same crap we've heard before. And here's the the steps they tossed launched a forensic investigation.

Wank Wank notified all affected customers via email, except when you probably breach the privacy laws by not fully disclosing everything. Set up a dedicated phone line. Notify the office of the Australian Information Commissioner, which they are required to do by law whether or not they're gonna do anything. Dad, slap on the wrist, notify the Western Australian Police in the Australian Federal Police good Anya What about notifying us of everything and you might be wondering why people would have to provide so much information like passport and driver's license and other identifying important identifying documents for something like this? Well yeah, the Federal Government to think for that.

Under the Federal Government Anti Money Laundering and Counterterrorism Financing Act of 2006, Under the Australian Transit the Austrack it's called the Austrack Reporting Requirements. Any company dealing with monetary items, financial services, precious metals, currency exchange houses that are use and anything to do with cryptocurrency. any like online crypto currency trader that deals in Australia must follow these Austech requirements and they have to gather all this information. In fact, some of the crypto companies make you hold up a sign like a handwritten sign with the photo of your ID to make sure it matches to these reporting requirements and it basically says that if you transact over five thousand dollars, well, you could be a terrorist or a money launderer.

oh I've got to stop him so ya know you can't buy anything legit over five thousand dollars here in Australia No, just take me away in handcuffs now. I'm obviously a criminal and I found this also with my currency exchange house that I use I buy as you know I buy lots of stock and stuff from overseas and these are really big value stuffs I've got a convert into US Dollars and then I've got to convert that a good rate send overseas and every time I do that, especially the for the very large value transactions I've got to prove time and time again not only Who I am and why I'm doing this, but also the source of the funds as well. It's ludicrous. Not a freaking business and coming soon in Australia we won't be able to buy anything over $10,000 in cash because we're obviously criminals.

If you pay that sort of money in cash, you've got to be a criminal. Now you've got to be working in the black market economy and all that sort of stuff. Great. So what a monumental screw-up I Know this sort of stuff happens all the time and everyone's gonna go.

Me: So what? No big deal? Hmm everyone I know is that their personal data stolen? What's the big deal? It's common as mud. Well, the problem is, this should be preventable trust in third parties like this when I'm sure they could have easily handled this sort of stuff in-house This is not some, you know huge high-volume thing. it's just the Perth Mint They could have dealt with this in-house kept their own in-house security, and because that's a government agency, you expect better. But that's probably a dumb thing to expect right that the government going to do things right? anyway.

I Just had to make this video to just make people aware that this stuff is still happening and it's happening to government organisations as well and hopefully keep putting pressure on governments and other businesses that data security is really important and there can be a huge flow on effects when the data is breached. Personal Information People's information security is huge these days. Identity theft is a really big thing. Completely screw people's lives up.

so if you liked that video, please give it a big thumbs up. If you've been had your identity stolen or personal information data breach like this, leave it in. The comments are on the Eevblog forum thread for this video down below. Let us know all about it, so catch you next time and let's have a slow clap for mister deer-in-headlights here, huh? Well done, you.