Sydney, Australia – March 27, 2024 

Thousands of subscribers to Nine newspapers, including the Sydney Morning Herald, The Age, and The Australian Financial Review, have had their personal data exposed online in a significant cybersecurity breach.

*See the link to the CRIKEY article at foot of this article

Key Details:

• Affected Subscribers: Approximately 16,000 subscribers were impacted.
• Exposed Data: The compromised data includes names, postal addresses, and email addresses.
• No Financial Data Compromised: Nine has confirmed that payment details and passwords were not affected.
• Third-Party Supplier Breach: The breach originated from a third-party supplier that had access to subscriber data.
• Discovery by Security Researcher: Security researcher Kaspar (@bucketchallenge@infosec.exchange on Mastodon) discovered the exposed data in an unsecured Amazon S3 bucket.
• Nine’s Response: Nine has stated that it is contacting all affected subscribers and has worked with the third-party supplier to resolve the issue.⁴ They also claim that the data is no longer publicly visible.
• Potential Risks: Despite the absence of financial details, the exposed data leaves subscribers vulnerable to phishing scams and other cyberattacks. Security researcher Martin Seeger highlighted that payment amounts were also exposed, which can be used to add credibility to phishing attacks.
• Nine’s Data Practices: Nine has a large collection of personal data on its users, which is used for advertising purposes.
• S3 Bucket Vulnerabilities: Exposed S3 buckets are a common cybersecurity issue, with previous incidents involving significant data leaks.⁵
• Second Major Breach: This incident follows another recent breach where 9,000 sensitive court files were downloaded from the NSW Courts online registry.

The Breach and Its Implications:

Nine’s spokesperson stated that the breach occurred due to an “unauthorized change” that left the subscriber data unprotected. The discovery of the exposed data by a security researcher underscores the ongoing challenges in securing cloud-based data storage.

While Nine asserts that its internal systems were not compromised, the reliance on third-party suppliers introduces vulnerabilities. The release of personal information, even without financial details, can be exploited by cybercriminals to conduct targeted attacks.

Recommendations:

• Affected subscribers should be vigilant for phishing emails and other suspicious communications.
• Nine is urging affected customers to be very aware of any email they receive, and to be very wary of any requests for information.
• Companies are urged to increase security around third party data sharing, and to do regular security audits.⁷

The incident highlights the importance of robust cybersecurity measures and the need for companies to protect the personal data of their subscribers.