Data leak at Palo Alto Networks

[German]Palo Alto Networks may have had a data privacy incident. A service provider is responsible for ensuring that employees’ personal data was publicly accessible.


Advertising

I became aware of this data protection incident via the following tweet by Aryeh Goretsky (ESET security researcher).

 

KRITIS-Netzwerk
(Source: Pexels Markus Spiske CC0 Lizense)

Incident confirmed

According to this article on Techradar, Palo Alto Networks has already admitted the privacy violation against the medium Business Insider. This led to the personal data of both former and current employees being shared online.


Advertising

Palo Alto Networks, Inc. is a U.S. multinational cyber security company headquartered in Santa Clara, California. Its core products include a platform with advanced firewalls and cloud-based capabilities that extend these firewalls to other aspects of security. The company has more than 60,000 customers in over 150 countries.

Business Insider was alerted to the incident by a former Palo Alto Networks employee who wanted to remain anonymous. Palo Alto Networks then confirmed to Business Insiders that the personal data of around seven current and former employees had already been “accidentally” put online in February by an external service provider. The names, birth dates and social security numbers of the employees were made public.

Details remain unclear

However, Palo Alto Networks remains silent about the name of the external company and has not yet disclosed where the information has leaked. A spokesperson for the cyber-security company reported on the incident with Business Insider:

“We took immediate action to remove the data from public access and terminate the vendor relationship. We also promptly reported the incident to the appropriate authorities and to the impacted individuals. We take the protection of our employees’ information very seriously and have taken steps to prevent similar incidents from occurring in the future.”

Whether the data protection incident is classified as ‘accidental’ or ‘intentional’ by the service provider is unknown.


Advertising


This entry was posted in Security and tagged . Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *