16 year old Joshua Rogers, a self-described white-hat hacker, told Fairfax and ABC he found the database of people who used the old Metlink online store by chance.
Metlink was the Transport Department's ''shop front'' for public transport users before Public Transport Victoria's formation in 2012. An estimated 600,000 entries were found in the database.
"I was actually looking for the cost of Boxing Day tickets and Christmas Day tickets and found an error on the website," Rogers told the ABC.
"Just from basic instinct I knew what the error meant and how it could be leveraged for database access."
Rogers told the news outlet the issue was poor worksmanship from whoever had designed the PTV website.
"50% of all websites are vulnerable to this type of attack and it's purely from lazy coding," he said.
|
|
"When companies take money from the development side and just pocket it themselves.
"They just don't invest enough money in security. Absolutely easy to fix. But you just have to know what to do."
A spokesperson for PTV told reporters it has fixed the problem and has referred the matter to Victoria Police.
"PTV takes security breaches very seriously and has referred the matter to Victoria Police for investigation and to Privacy Victoria," he said.
"PTV can confirm that this is the only known attack on its website.
"Customers can rest assured that the database is in no way linked to myki online accounts and no useable credit card details were stored in the database."
The news comes amid massive attacks late last year on Adobe, which was described as the "worst of its kind in 10 years."
