EXCLUSIVEPersonal data of 1.3million Brits was left at the mercy of hackers and fraudsters after it was exposed online by a neighbourhood watch scheme used by 33 police forces
- Neighbourhood Alert system let users see personal details of anyone signed up
A digital neighbourhood watch scheme used by 33 police forces left the personal data of up to 1.3million people at the mercy of hackers and fraudsters, the Daily Mail can reveal.
The Action Fraud-backed Neighbourhood Alert system allows concerned citizens to message each other and receive bespoke updates about local crime.
But until last week, the platform's defective security permissions let anyone with an email address to sign up and see phone numbers, addresses, and in some cases photos belonging its users.
The design flaw allowed members to draw city-sized neighbourhood watch scheme boundaries on a map and obtain data on hundreds of thousands of signed-up 'suggested members' who live within the boundary.
Local fire and rescue departments, police and crime commissioners, and councils are also signed up to the network.
Digital neighbourhood watch Neighbourhood Alert (pictured) used by 33 police forces left the personal data of up to 1.3million people at the mercy of hackers and fraudsters
A design flaw allowed members to draw city-sized neighbourhood watch scheme boundaries on a map and obtain data on hundreds of thousands of signed-up 'suggested members' who live within the boundary
They all offer re-branded websites of the scheme, such as actionfraudalert.co.uk for Action Fraud, but all the data belongs of the Neighbourhood Alert database.
This means that while someone could have signed up through their local police force alert system in the north of England, they could still scour data pooled by a different scheme in the south of the country.
Among those whose name, phone number, and address was made public were MPs, civil servants and police officers.
One victim is understood to be a veteran intelligence officer responsible for tackling international organised crime.
The error was only fixed after data protection experts tipped off VISAV Ltd, the company responsible for managing the scheme, earlier this month.
VISAV - a web design firm which started life in 1998 as a Nottinghamshire tourism promoter and still runs a Robin Hood-themed gift shop - emailed users to say it had fixed a 'technical anomaly' and warned of 'the possibility that your contact details may have been exposed.'
Both VISAV and the Neighbourhood Watch Network initially insisted that the breach was limited to a single mistakenly-approved scheme affecting just 121 people - but finally admitted the problem when a reporter explained in detail how the design flaw could be systematically exploited by fraudsters.
'We are extremely sorry that there was a loophole in the Alert System,' said Neighbourhood Watch Network CEO John Hayward-Cripps (pictured)
The platform's defective security permissions let anyone with an email address to sign up and see phone numbers, addresses, and in some cases photos belonging its users
Neighbourhood Watch Network CEO John Hayward-Cripps said: 'We are extremely sorry that there was a loophole in the Alert System.
'This enabled someone posing as a local Neighbourhood Watch Coordinator to undertake some unusual actions on the system.
'This gave them access to the contact details of people who had signed up to Neighbourhood Watch within the bogus scheme areas.
'We have been reassured that the data visible was contact details - name, first line of address, phone/email and a small profile picture.
'This loophole has now been closed and we are reviewing the processes and what we can learn.'
VISAV Product Director Mike Douglas added: 'We are sincerely sorry for any distress caused to all our registered members due to this unusual risk of a leak taking place.
'We have reported ourselves to the ICO to support our own intensive investigation and help prevent future risks.'
An Action Fraud spokesperson said: 'We are aware of an incident on the Neighbourhood Alert system and we understand that the Action Fraud alerts were not affected by this issue.'
