British tabloid The Sun has warned some of its readers that their personal information, including phone numbers and passwords, could have been compromised in the recent hack attack and could be published online by hackers.
The Rupert Murdoch-owned tabloid said in a email to readers that information of people who took part in competitions and polls on its website may have been stolen.
Last month, in what is believed to be the first attack on a major British newspaper, Lulz Security (LulzSec), hacked and redirected readers of The Sun to a fake page on the New Times site. The page claimed that media businessman and owner of The Sun Rupert Murdoch had been found dead in his garden after he had "ingested a large quantity of palladium."
The Sun’s website address then re-directed readers to LulzSec’s Twitter page, where it claimed responsibility for the breach. It is thought that the attack was a mark of protest against corporate wrongdoing. News International took down the page and shut down other pages as a precautionary measure.
News International director of customer management Chris Duncan wrote on Monday about the breach. Duncan said: "As you may be aware, on July 19 the Sun website was subject to an organised criminal attack. It has now come to our attention that some customer information from competitions and polls was breached as part of this attack."
"Details vary, but could include name, address, date of birth, email and phone numbers. No financial or password information was compromised. We are contacting you because we believe that information that you submitted to us could have been accessed, and may be published online by the group responsible," said Duncan.
LulzSec has claimed that it is in possession of a large cache of emails, of up to 4GB, which it hacked from different servers where News International stored its data. The group first warned that it would release the data immediately, but later said that it would refrain from publishing stolen emails as it may compromise the court case.
A tweet allegedly from the hacker group said: "We think, actually we may not release emails from the Sun, simply because it may compromise the court case."
LulzSec is infamous for its hack attacks on Sony, Nintendo, FoxNews, InfraGard and more.
"Cybercriminals will be rubbing their hands in glee at getting hold of data such as names, email addresses, dates of birth and phone numbers," said Graham Cluley, senior technology consultant at Sophos. "The stolen information can be used to target innocent individuals. For instance, a scammer could email a beauty contest applicant, trick them into believing that it was the newspaper contacting them and attempt to steal money or further information."
"Large scale, high profile data breaches continue to hit the headlines and companies really need to take heed about what’s going on, and consider the security of the information they store on their systems," Cluley added. "Questions will inevitably be asked to why the sensitive information about readers and competition entrants wasn’t safely stored using strong encryption."
