sus.botdocs

Privacy finding

A page contains what looks like sensitive personal data

Privacy Error Severity: High

Part of the audit Personal data on pages. Finding id: privacy.personalDataOnPages.

What it costs you

Anyone can read and copy this, and so can search engines and AI crawlers. If it is real personal data, it is a data breach the moment it is published.

What to do

Open the page, confirm whether the value is real, and remove it. If it is a password or key, replace it as well: removing it from the page does not make it secret again.

What it checks

  • National ID numbers on pages
  • Payment card numbers on pages
  • Bank account numbers on pages
  • Health details next to names
  • Passport details on pages
  • Passwords or keys in page code
  • Large lists of people

How to fix it

Revoke the credential

  1. Revoke the password, key or token where it was issued, and issue a new one.
  2. Remove it from the page source and keep the new one on the server.
  3. Look in the logs of the service for use of the old credential.

How to check: The old credential no longer works. Run this rule again after the next crawl.

Decide whether the list of people should be public

  1. Ask the owner of the page who the people are and whether they know the list is public.
  2. Remove the list, shorten it or put it behind a login where it should not be public.

How to check: Run this rule again after the next crawl.

Remove the data and what still holds a copy

  1. Remove the value from the page, including HTML comments and hidden fields.
  2. Ask search engines to refresh the page, so the old copy leaves their results.
  3. Check with your data protection officer whether the publication has to be recorded or reported.

How to check: Run this rule again after the next crawl.

A real case

In December 2019 the UK Cabinet Office put a file on GOV.UK with the names and home addresses of more than 1,000 New Year Honours recipients, and it stayed online for about two hours. The data protection regulator fined the department 500,000 pounds, cut to 50,000 pounds by agreement in November 2022.

Source: Infosecurity Magazine, 4 November 2022, on the ICO fine against the Cabinet Office

Thresholds

Thresholds for A page contains what looks like sensitive personal data
NameDefaultMeaning
min_people_in_list25A page is reported as a bulk list when it names at least this many people.