Sensitive personal documents belonging to many job applicants and staff of the Oyo State Teaching Service Commission (TESCOM) have been left exposed on the internet in an unprotected cloud storage.
The documents, which include national identity slips, birth certificates, medical reports, passport photographs, letters of employment and bank information, are accessible through a Google Cloud indexed directly on TESCOM’s official government website.
At the time of this report, any user with below average dorking skills needs no login or password to access the files. Essentially, the folder is visible through public search results.
The exposure is not the result of any cyberattack or hacking activity. Instead, it is due to a basic failure by the government to secure its digital infrastructure.
The documents, many of which were submitted by applicants during TESCOM recruitment exercises, were stored in a publicly indexed online folder that was not protected from search engines or unauthorised users. At the time of drafting this report, the records were open to the world online.
Some of the victims include Akolawole Mathew, whose national ID was left exposed; Oladosu Olalekan Moses and Agbato Samuel, whose credentials were publicly available; Adesina Olajide, whose NYSC certificate was exposed; and Olawale Tunbosun, whose primary school certificate was found in the open file bucket.
This form of carelessness directly violates the Nigeria Data Protection Act (NDPA) and whatever guideline the National Information Technology Development Agency (NITDA) has designed to protect the privacy and personal data of Nigerians.
According to the regulations, any platform or medium that collects or stores personal data must ensure it is secure and protected against unauthorised access or disclosure.
The possible risks associated with this level of data exposure. With access to names, addresses, NIN details, employment history and even health-related records, fraudsters could impersonate victims, apply for loans in their names or target them with scams.
Others may become victims of identity theft or digital blackmail. In some cases, even internal memos and staff redeployment letters were left in the open, exposing details about internal government operations and employee status.
CASE STUDIES OF ASSOCIATED RISKS
In 2023, the identity of Jonah Chukwudi, a Lagos based sales person, was used to fraudulently extort money from his family and friends.
According to The Punch’s report of the incident, someone had created fake social media profiles in his name, using his phone number, email address and other personal details harvested from unsecured websites.
The impostor had reached out to his contacts to promise business deals and loans worth thousands of naira before the fraud stopped.
Similarly in March, a Lagos High Court found Innocent Joseph Odumusor and Ajose Samuel Chukwudi guilty of impersonation and possessing fraudulent documents. The duo had printed and used a bundle of fake letters sourced from someone else’s email account to convince victims they represented legitimate businesses.
Both men admitted in court that they knew the papers were false, and Justice Abike Fadipe sentenced each to one year’s imprisonment with the option of a N200,000 fine.
On August 15, 2023, the Federal High Court in Ikoyi sentenced 30‑year‑old Hakeem Ayotunde Olanrewaju to two years’ imprisonment (or a N200,000 fine) after he admitted stealing the identity of a businessman and withdrawing $22,000 and N500,000 using forged manager’s cheques.
Olanrewaju had used the victim’s name, signature and account details — harvested from an unsecured digital form — to impersonate him in bank transactions.
Some of the victims of the insecure data storage in the case of the Oyo TESCOM stand the risk of falling victim to any of these criminals.
HOW FIJ FOUND THE DATA
FIJ found the data window while auditing the website of Nigerian subnational agencies for safety, data privacy and security. A simple online search by simply applying the methods of ‘Google dorking’, which allows users to find insecure web pages and directories.
The presence of the documents in a government-linked domain suggests there was no attempt to restrict access or apply basic security measures.
A properly designed recruitment platform would have prevented such access by ensuring the files were stored on a backend server, protected by authentication, and not indexed by search engines. The TESCOM website, however, failed to meet any of those minimum requirements.
This is not the first time a Nigerian government website has exposed citizen data. In previous years, similar lapses have been recorded across state agencies and federal departments, but enforcement of data protection rules has remained weak.
The NDPA, which has been in effect for about two years, requires every data-collecting institution to appoint a Data Protection Officer and implement a data protection policy. There is no indication that TESCOM has done either.
The legislation also states that individuals whose data have been exposed must be notified promptly and offered redress. However, there is no evidence that affected applicants or staff have been contacted or informed.
Here is what the act states verbatim:
“(3) Where a personal data breach is likely to result in a high risk to the rights and freedoms of a data subject the data controller shall immediately communicate the personal data breach to the data subject in plain and clear language, including advice about measures
the data subject could take to mitigate effectively the possible adverse effects of the data breach and if a direct communication to the data subject would involve Personal data breaches disproportionate effort or expense, or is otherwise not feasible, the data controller may instead make a public communication in one or more widely used media sources such that the data subject is likely to be informed.”
Post a Comment