Telegraph newspaper bares 10TB of subscriber data and server logs to world+dog

The Telegraph newspaper managed to leak 10TB of subscriber data and server logs after leaving an Elasticsearch cluster unsecured for most of September, according to the researcher who found it online. The blunder was uncovered by well-known security researcher Bob Diachenko, who said that the cluster had been freely accessible …

[DrXym]

I used to love reading the Telegraph

It was one of the first newspapers that had a useful website. Even 20 years ago you could read the paper and it was a neat thing to do while chilling out with the first coffee of the day. Unfortunately the quality of the site went seriously downhill as they lurched to the hard right and finally hid behind a paywall so I don't honestly miss it these days.

[Anonymous Coward]

Re: I used to love reading the Telegraph

Case of knowing your enemy I suggest. The comments can be a most unsavoury illumination.

[jollyboyspecial]

Re: I used to love reading the Telegraph

Lurched to the hard right? The Torygraph has been hard right for a lot longer than they have had a website.

[DrXym]

Re: I used to love reading the Telegraph

I don't care if a boardsheet newspaper has a left or right viewpoint and as I say I used to enjoy it. I appreciate other points of view providing they are rational and reasoned. But the Telegraph lurched ALL the way to the far right and stopped being reasonable.

It began hiring some utterly repugnant columnists who would trot out climate change denial or rail about immigrants or science. It was just nasty indefensible shit designed to be clickbait and to widen the appeal of the paper particularly to US audiences.

Anyway I'm glad for the paywall. The less eyeballs seeing that, the better.

[Dan 55]

Re: I used to love reading the Telegraph

During the 2019 Conservative leadership election, The Daily Telegraph endorsed Boris Johnson.[39] In 2019, former columnist Graham Norton, who had left the paper in late 2018, said "about a year before I left, it took a turn" and criticised it for "toxic" political stances, namely for a piece defending US Supreme Court then-nominee Brett Kavanaugh and for being "a mouthpiece for Boris Johnson" whose columns were allegedly published with "no fact-checking at all".[40]

Source

[AMBxx]

Re: I used to love reading the Telegraph

Paywall is easer to go round/through. Just use NoScript.

[RegGuy1]

Re: I used to love reading the Telegraph

Why, then you get to the Telegraph. Best to turn round and go the other way.

[Aitor 1]

Re: I used to love reading the Telegraph

Not ok to do it.. even if we don't like them.

[elsergiovolador]

Re: I used to love reading the Telegraph

They seem to be supporting the government that turned hard left with high tax, high spend, overreaching big government, anti small business measures and so on. Even some Labour MPs are considering joining new socialist Tories.

[Anonymous Coward]

Re: I used to love reading the Telegraph

But I notice they don't know how to use the word Brexit.

[Eclectic Man]

Re: I used to love reading the Telegraph

Their political cartoonist is in a bit of rouble:

https://www.huffingtonpost.co.uk/entry/telegraph-cartoonist-bob-moran-anti-vaccine_uk_61531577e4b06beda4747bc5

"Bob Moran, The Telegraph’s cartoonist, has got into a messy Twitter row with an NHS doctor over his anti-Covid vaccine stance.

On Monday, Dr Rachel Clarke revealed she had been verbally abused in public for wearing a mask – only for Moran to reportedly “openly abuse” her in response.

His original tweet aimed at Clarke had to be removed by the social media platform because it “violated the Twitter rules”.

Moran is believed to have replied encouraging further verbal abuse against Clarke for “the rest of her worthless existence” according to a screenshot caught by journalist Otto English."

[Anonymous Coward]

Re: I used to love reading the Telegraph

"a bit of rouble"

Paid for by Putin?

[Anonymous Coward]

Re: I used to love reading the Telegraph

It was one of the 1st newspaper websites of any use on the internet. Was reading it from circa 1994.

But after the Weirdo Brothers took over in 2004 it went to shit.

[King Olaf]

Re: I used to love reading the Telegraph

"Hard right" my ass. It is as pathetically Woke/PC/Cultural Marxist/subversive as most of our pathetic political class, with the only thing that could define it as "right wing" being the obsession with money. They simply are not censoring subscribers comments like certain other technology websites have been doing in the last couple of years - cough!

[Dave314159ggggdffsdds]

Re: I used to love reading the Telegraph

If you think the Telegraph is "Woke/PC/Cultural Marxist/subversive", then you're a far right nutjob.

[ICL1900-G3]

Re: I used to love reading the Telegraph

Dave - seconded!

[Anonymous Coward]

Karma?

I mean, it is the torygraph, after all.

[G40]

Thank God I use a burner address. Cretins, almost as cretinous as their content.

[Potemkine!]

Knowing the Telegraph, it's probably because of the European Union.

[Anonymous Coward]

My best money-making tip is still: 'do not get your economics news from the Telegraph'. With Ambrose Evans-Pritchard and his twice-weekly-article-series-about-how-the-euro-currency-is-about-to-collapse now entering it's 22nd consecutive year.

[Dan 55]

The eurozone is safe for a couple of weeks every summer, when Ambrose goes on holiday.

[I ain't Spartacus]

To be fair, Ambrose Evans-Pritchard also tends to predict a global recession (charts on so-and-so are flashing red headlines) about every six months as well. So at least he's consistent...

At least on the economics of the Euro he's often right. They're disastrous, and over a decade after that became painfully clear the mechanisms haven't been agreed (let alone put in place) to fix it. The thing he gets wrong is the politics. There is almost infinite political will to keep fixing the Euro, and almost no politically possible way to leave. So for it to collapse requires a large economic crisis that moves so swiftly that the politicians can't dance fast enough to keep it patched up.

[Anonymous Coward]

re. now entering it's 22nd consecutive year

even half a broken clock..., etc. ;)

[Anonymous Coward]

Telegraph readership

A list of subscribers to the Daily Telegraph? That is a goldmine for spammers selling walk-in baths, shoes with velcro instead of laces, and trousers with elasticated waistband.

[Mishak]

What's wrong with shoes with Velcro?

At least the darn cat can't bite the laces off...

[Blazde]

Data with no meaning

Telegraph koan of the day

[teebie]

That seems like a lot of data.

[Primus Secundus Tertius]

Was it them who gave my email address to the spammers who keep telling me my McAfee subscription has expired?

[TheProf]

Yes. Yes it was. You should sue.

[elsergiovolador]

IR35

Just check what they write about this "reform" to gauge their credibility.

[Anonymous Coward]

Re: IR35

IR35 -- what's that then?

[Empire of the Pussycat]

"...details of at least 1,200 Telegraph subscribers..."

That'll be all of them then.

[Anonymous Coward]

Re: "...details of at least 1,200 Telegraph subscribers..."

They claim only 0.1% affected, so they appear to be saying there are 1.2m actual subscribers... which sounds over the top when you add in all those delivered by paperboy to be ironed by footmen, all those left in hotels and government, media and financial offices, and all those given free with a bottle of mineral water

[Dave314159ggggdffsdds]

Re: "...details of at least 1,200 Telegraph subscribers..."

Subscribers to the website - you have to sign up with a throwaway account to read half the stuff on there. The other stuff is fully paywalled.

I must have created a few dozen accounts since they added the paywall.

[Pascal Monett]

"Unsecured Elasticsearch clusters are relatively common"

Is it time to declare ElasticSearch a security threat yet ?

If not, when ?

[Pirate Dave]

Does "TB" mean something less in the UK than here in the States? 10 TB for "subscriber data" and http logs seems way over the top, unless it's years' and years' worth.

[RegGuy1]

Tony Blair.

[Anonymous Coward]

Oh God, the very thought of 10 Tony Blairs of data.

[Anonymous Coward]

Flim flam

It would be really interesting to hear what the researcher who found the data thinks about the veracity of "...technical data, the vast majority of which had no meaning. Within that data was a small amount of system login data - less than 0.1 per cent of our subscriber/registrant database".

I also don't see any acknowledgement of the Torygraph having reported this breach of GDPR protected data to the appropriate supervisory authorities. I assume that they really don't want to answer awkward questions like: If the database was storing personal information, why was it not encrypted? Getting the answer to that one wrong is like giving the regulator an extra D20 for when he rolls for damage!

The PR-droid's statement reads to me like a "shrug. nothing to see here" response. An arrogant downplaying of the facts from someone who gives significantly less than a toss about other people's data being served from their incompetently configured Elastic instance.

[JimboSmith]

Re: Flim flam

I also don't see any acknowledgement of the Torygraph having reported this breach of GDPR protected data to the appropriate supervisory authorities. I assume that they really don't want to answer awkward questions like: If the database was storing personal information, why was it not encrypted? Getting the answer to that one wrong is like giving the regulator an extra D20 for when he rolls for damage!

I too noticed that the response from the paper didn't mention the ICO. That has to be a must in a case like this.

[Ken Hagan]

Re: Flim flam

I'm sure El Reg can manage a follow-up question on this subject.

[Dave314159ggggdffsdds]

Re: Flim flam

Chances are that very few or none of the 'accounts' were set up with real data. I can well believe there are 1.2m throwaway accounts that have been created to access the stuff that's only semi-paywalled. I don't believe for a second that there are 1.2m people paying to access the website in full. That would be 5x the Graph's circulation.

It's actually an interesting question: if personal data is effectively anonymised by being shoved into a list that is almost entirely fake, is it effectively 'secured'?

[Missing Semicolon]

Crumbs

The Guardian readers are out in force today!

[Anonymous Coward]

Re: Crumbs

You've spelt Grauniad wrong.

[Binraider]

Boris' boss screwing up. As if they could screw up more than they already have (unless you're a property magnate farming off tax loopholes).

[Fruit and Nutcase]

They've got their mark's wife on the front page today. Though that is par for the course with the Telegraph - their front pages tend to have a high proportion of pictures of female subjects...*

https://www.bbc.co.uk/news/blogs-the-papers-58811341

*come school exam result time in the UK, for quite a few years, they could be guaranteed to have a photo of female students jumping up with their results letters in their hands.

[RegGuy1]

Hmm -- it smells to me

We are aware that there was a time limited exposure of technical data, the vast majority of which had no meaning.

and

We take this matter extremely seriously and took quick action to resolve this issue and close down the exposure.

So they had meaningless data that they don't take seriously. Applying the sniff test it looks like someone's filled their trousers. We have been in touch with the small number of those who have been affected -- that depends how you define small. I mean, 100,000 is small compared to 10,000,000. It's all relative.

Shouldn't these things get reported to the ICO? Or does the GDPR no longer apply now we've left the EU? (Sorry, this is the Torygraph, so shouldn't mention that.)

[Anonymous Coward]

Re: Hmm -- it smells to me

"Or does the GDPR no longer apply now we've left the EU?"

The UK GDPR now applies, where it was basically created by taking the EU GDPR and crossing out any references to EU and writing in UK instead. The (if a legal document ever can be) "easy-to-read" UK GDPR document has yet to be published, the "messy" (i.e. red-ink changes) version is here: https://www.gov.uk/government/publications/data-protection-law-eu-exit

The UK GDPR is currently basically 99.999999999% the same as the EU GDPR.

[Dave314159ggggdffsdds]

Re: Hmm -- it smells to me

The 'meaningless data' part is fair enough. Most of those are throwaway accounts.

I'm guessing the small number of people are the very few real accounts that were leaked. I don't think they represent a large proportion, they leaked 1200 accounts in total, it might well be in the 1-10 actual people range, and 1190-1199 throwaway accounts range.

[Anonymous Coward]

10 TB

lol

There are 67M or so people in the UK. 10TB storage means 150Kb per head.

Quite a lot of data if it is filled in.

[Ken Hagan]

Re: 10 TB

Perhaps the leak includes every below-the-line comment ever posted by a given user. That could easily add up to 10TB of largely meaningless data, regardless of which publication is involved.