http://www.bbc.co.uk/news/technology-11418962

 

The personal details of thousands of Sky broadband customers have been leaked on to the internet, alongside a list of pornographic movies they are alleged to have shared online.

 

The list, seen by BBC News, details the full names and addresses of over 5,300 people thought by law firm ACS:Law to be illegally sharing adult films.

 

It appeared online following an attack on the ACS:Law website.

 

The UK's Information Commissioner said it would investigate the leak.

 

Privacy expert Simon Davis has called it "one of the worst breaches" of the Data Protection Act he had ever seen.

 

Data breach

The documents appeared online after users of the message-board 4chan attacked ACS:Law's site in retaliation for its anti-piracy efforts.

 

The firm has made a business out of sending thousands of letters to alleged net pirates, asking them to pay compensation of about £500 per infringement or face court.

 

It uses third-party firms to scour the net looking for possible infringements of music and film copyright.

 

Armed with IP (internet protocol) addresses - which can identify the internet connection used in any copyright infringement - its lawyers can then apply for a court order to get the physical address of the PC from the service provider whose network has allegedly been used for the file-sharing.

 

A BBC investigation in August found a number of people saying they were wrongly accused by ACS:Law of illegal file-sharing. UK consumer group Which? says it has also received a number of complaints. Many contest that IP addresses can be spoofed.

 

ACS:Law is under investigation by the Solicitors Regulation Authority over its role in sending letters to alleged pirates.

 

The leak contains around 1,000 confidential e-mails, along with the list, which was an attachment on one of the messages.

 

The collection was then uploaded to file sharing website, The Pirate Baywhere it is being shared by hundreds of users.

 

The confidential e-mails include personal correspondence between Andrew Crossley - who runs ACS:Law - and work colleagues, as well as lists of potential file-sharers and information on how much the firm has made through its anti-file-sharing activities.

 

While some of the e-mails, detailing the internal workings of the company, may prove embarrassing, the leaking of an unencrypted document - that lists the personal details of more than 5,300 BSkyB Broadband subscribers alongside a list of adult videos they may have downloaded and shared online - could be a breach of the Data Protection Act.

 

Speaking to BBC News, Mr Crossley said there were "legal issues" surrounding the leak.

 

"We were the subject of a criminal attack to our systems. The business has and remains intact and is continuing to trade," he added.

 

Mr Crossley said he would not comment directly on the contents of individual e-mails.

 

 

"All our evidence does is identify an internet connection that has been utilised to share copyright work," he told BBC News when pressed about the BSkyB database.

 

"In relation to the individual names, these are just the names and addresses of the account owner and we make no claims that they themselves were sharing the files," he added.

 

Mr Crossley said he had no further comment when asked why the Excel document was unencrypted, but said he had notified the police, the ICO and was in communication with the SRA.

 

A spokesperson for Sky told BBC News that they were "very concerned at the apparent security breach involving data held by ACS:Law".

 

"At this stage of our investigation, we believe that the data included the names and addresses of around 4,000 Sky Broadband customers," they said.

 

"Like other broadband providers, Sky can be required by Court Order to disclose information about customers whose accounts are alleged to have been used for illegal downloading. We only ever provide such data in encrypted form."

 

Direct action

Simon Davis, from the watchdog Privacy International, said he would be asking the Information Commissioner to "conduct a full investigation" and hoped it would be "a test case of the Information Commissioner's new powers".

 

"You rarely find an aspect where almost every aspect of the Data Protection Act (DPA) has been breached, but this is one of them," said Mr Davies.

 

"It fits perfectly for the term 'egregious misuse' of personal data," he added.

 

A spokesperson for the Information Commissioners Office (ICO) told BBC News that it "takes all breaches of the DPA very seriously".

 

"Any organisation processing personal data must ensure that it is kept safe and secure.

 

"The ICO will be contacting ACS:Law to establish further facts of the case and to identify what action, if any, needs to be taken."

 

BSkyB is yet to make an official statement on the matter, but said it was investigating the breach.

 

The attack on ACS:Law is the latest in a number of high-profile attacks by piracy activists.

 

Last week, hackers temporarily knocked out the websites of the Motion Picture Association of America (MPAA) and the Recording Industry Association of America (RIAA).

 

The attacks were declared on notorious message-board 4chan and were reportedly in retaliation for anti-piracy efforts against file-sharing websites.

 

Users of 4chan are renowned for online activism and direct action. "Operation Payback", as it was known, was reportedly revenge for the MPAA and RIAA's action against The Pirate Bay.

 

The group has declared it will continue to target other sites involved in anti online piracy activity.

 

So, it seems that the anti-piracy crap has reached the UK. What do you think about this? I think it's ridiculous that Sky would have an unencrypted file of over 5000 people's addresses. And to track down IP addresses has many flaws in it...

1) ACS Law is old news been around for AGGGEES

 

2) It's not Sky who made or lsot the file, it was ACS Law

1) ACS Law is old news been around for AGGGEES

 

2) It's not Sky who made or lsot the file, it was ACS Law

 

Oh? I was just under the impression that Sky lost the file and it was leaked through ACS Law. But isn't there laws against illegally obtaining personal details against potential law infringer's? Seems a bit fishy to me.

So, it seems that the anti-piracy crap has reached the UK

 

This is new?..

 

I don't know if it is related to this, but a friend of mine at 6th Form got a letter of damages in the post about a week ago demanding £500 as compensation for a porn film he downloaded illegally. He has no plans to pay it though, as the loophole in the law requires them to prove it was him who downloaded it, and it could have been someone spoofing his IP address.

 

He says it was worth it, though.

So 4chan reached them too? Haha I'm actually supporting 4chan a little bit atm, I hate anti pirating sites.

So basically they got owned. When I first read it, I thought it was a list of members of the law firm who had downloaded porn and were illegally sharing it. I was laughing hysterically until i re-read it. I enjoy 4chan's work in this case. The suits tried to get their noses into things and got a little bit back.

1) ACS Law is old news been around for AGGGEES

 

2) It's not Sky who made or lsot the file, it was ACS Law

 

Oh? I was just under the impression that Sky lost the file and it was leaked through ACS Law. But isn't there laws against illegally obtaining personal details against potential law infringer's? Seems a bit fishy to me.

 

 

No ACS Law track down suspected piracy via the ip address. Then using this they can get a court order that will give them the data of the connection currently using the ip, meaning the internet provider and their address etc. Hence they had a list of 5,000 sky broadband customers.

 

The issue is of course the system is heavily flawed, you can't sue a household for a crime one person commited for starters. Ip addresses change pretty much everytime you connect, so the address they get is pretty much never the one that commited the crime etc.

that's what you get for using Sky Broadband.

Can't stop the signal, but you can sure hurt a lot of people trying.

To think, my parents are considering switching to Sky :P

oh god, porn crackdowns?

oh god, porn crackdowns?

 

Should you be worried?

oh god, porn crackdowns?

 

Should you be worried?

You don't know Das at all do you?

 

 

Cant you like sue them for leaking your private info?

oh god, porn crackdowns?

 

Should you be worried?

You don't know Das at all do you?

 

 

Cant you like sue them for leaking your private info?

 

 

Both companies are British so possibly sueing them under the Data Protection Act.

 

Edit:

 

"The news could put BT in breach of the Data Protection Act, which requires firms to keep customers' data secure at all times"

 

Source: http://www.bbc.co.uk/news/technology-11434809

oh god, porn crackdowns?

 

Should you be worried?

Of course not.

I'm on Sky Broadband D:

 

Although we're cancelling and moving to an LLU provider, because Sky Broadband sucks.

im on sky <_<

Its ACS:law thats the problem here. They tried to reload their site after getting attacked, and it came up with no encryption. The file thats in question should have been encrypted by them, as it was just a normal excel spreadsheet, and they sent it unencrypted via email. They got a court order to get the identities of a lot of people and send out threatening letters, not just sky customers, O2 customers as well, and many others. I have recieved one, but not heard anything else about it, I was on O2 broadband. It now looks like they could be facing a £500,000 fine, which gives me endless joy to see them suffering.

oh god, porn crackdowns?

 

Should you be worried?

Of course not.

Das said, with his best pokerface he hoped that they wouldn't catch him.

The funnest thing about this is that the ACS Law boss was recieving MP3's through his emal account. Tut tut :shame: .

The funnest thing about this is that the ACS Law boss was recieving MP3's through his emal account. Tut tut :shame: .

Can 4chan get him to sue himself, I wonder... :-k

The funnest thing about this is that the ACS Law boss was recieving MP3's through his emal account. Tut tut :shame: .

Can 4chan get him to sue himself, I wonder... :-k

Or maybe get another law firm to sue him.

 

With the going rate of those lawsuits, it'd crumble his law firm instantly.