British Library / PLR ransomware attack, data now for sale

[turbobloke]

Includes passport scans apparently.

https://www.bbc.co.uk/news/entertainment-arts-6754...

[hidetheelephants]

turbobloke said:

Includes passport scans apparently.

https://www.bbc.co.uk/news/entertainment-arts-6754...

Why does the BL store passport scans? That seems like a pointless GDPR risk.

[IroningMan]

hidetheelephants said:

Why does the BL store passport scans? That seems like a pointless GDPR risk.

Employee proof of right to work in the UK, presumably?

[hidetheelephants]

IroningMan said:

hidetheelephants said:

Why does the BL store passport scans? That seems like a pointless GDPR risk.

Employee proof of right to work in the UK, presumably?

Once they've had sight of the document or a scan recording the passport number should be enough, it's an unnecessary risk retaining pointless data that needs to be secured.

[Countdown]

hidetheelephants said:

Once they've had sight of the document or a scan recording the passport number should be enough, it's an unnecessary risk retaining pointless data that needs to be secured.

I’m pretty sure HMRC requires the employer to keep a photocopy of the document.

[hidetheelephants]

Countdown said:

hidetheelephants said:

Once they've had sight of the document or a scan recording the passport number should be enough, it's an unnecessary risk retaining pointless data that needs to be secured.

I’m pretty sure HMRC requires the employer to keep a photocopy of the document.

Then HMRC ought to store it then; stupid requirement.

[turbobloke]

hidetheelephants said:

Countdown said:

hidetheelephants said:

Once they've had sight of the document or a scan recording the passport number should be enough, it's an unnecessary risk retaining pointless data that needs to be secured.

I’m pretty sure HMRC requires the employer to keep a photocopy of the document.

Then HMRC ought to store it then; stupid requirement.

It looks like an unnecessary risk. Since the story broke - possibly coincidentally - I've had an alert from Experian about an email address / password combo being for sale, the pw is fiction (like the others from previous alerts) so a low risk, and I don't use pw multiply anyway so the BL PLR pw is useless.

It's hardly surprising that an email address will make its way to naughty people eventually, but a passport scan is in a different league.