Peter A Clarke

Gumtree has had a data breach of indeterminate proportions last week according to the Hackers steal Gumtree users’ personal details, Gumtree ‘fesses up to breach and personal information leak and Australian Gumtree users targeted in hacking attack, with personal details stolen.

The Government website, Staysmartonline has also highlighted the potential of phishing attacks now that personal information has been obtained by hackers.

As is typical of the way that data breaches are dealt with in Australia the information from Gumtree has been very sparing and the response from the regulator even quieter.  With voluntary data breach notification only in Australia there is little incentive to notify in a more formal way.  It is in the best interests of an organisation to liaise with the Privacy Commissioner as he may investigate of his own motion and there may be consequences.  That said the Commissioner has been, at best, languid when dealing with data breaches.

The statement to affected users was:

“We are writing to let you know that some of your Gumtree account information was compromised in a security attack last weekend,” the email said.

“The attackers accessed your email address. Contact names and phone numbers, which are made publicly available on the site if provided, were also accessed.

“Your Gumtree account password was not accessed. Payment details were also not compromised; we don’t store any payment information on our site.”