Renters are being urged to think twice before uploading sensitive ID documents, after yet another privacy blunder from a property rental website.
More than 130 images of passports, birth certificates and driver's licences have been exposed in the breach.
1 NEWS has decided not to name the website, which is regularly used by Kiwis, as the files are still accessible.
Making matters worse, some are appearing on Google Images after a simple web search, making them increasingly difficult to remove.
When contacted about the privacy breach, the operator of the website said he was shocked.
In an email, he said, “the website [redacted] is a free platform to allow people to post their rental request”.
“It's a free service, anyone can post his/her pictures, and I'm surprised that people posted those sensitive images. I never think people will share such information on the internet."
The website is in the process of deleting the files 1 NEWS discovered, and has recently started asking people not to share sensitive documents.
However, people are still uploading their ID documents to the website. 1 NEWS has seen images of a person’s driver licence uploaded in the past few days and displayed on the home page of the website.
Jake Dixon, a security researcher with Vadix Solutions, says the move is likely too late.
"I have no doubt in my mind that someone with bad intentions has seen these documents."
He says renters need to be more critical of who they’re sharing sensitive documents with.
“This is a cautionary tale for people and what they should be sharing with organisations, specifically when they don't know how that data's being managed.”
It’s a message echoed by the Real Estate Institute of New Zealand.
Chief executive Bindi Norwell says there’s a lot of pressure on the rental market, and people will often do anything required to get themselves into a rental.
“It just means that people might feel the pressure to provide lots of information to organisations if they want that property.”
New Zealand’s new privacy laws come into effect from the 1st of December, aiming to bring accountability in this scenario.
Privacy Commissioner John Edwards told 1 NEWS that even if property websites don’t ask for such files, they’re still responsible for the files uploaded.
“The obligation is on the agency collecting the information to be clear with the individual what's going to happen with that information.”
A warning to ensure your site is secure, or face the consequences.
SHARE ME