Botched Post Office website upgrade caused serious data breach
A human error during a website upgrade caused the serious Post Office data breach earlier this year, which exposed personal details of hundreds of former subpostmasters, the public inquiry has been told.
In June, a document containing the names and addresses of victims of the Post Office scandal was accidentally published on the Post Office website.
It contained the names and addresses of all 555 subpostmasters who took part in the 2018/19 High Court Group Litigation Order (GLO) that proved bugs in the Post Office’s Horizon IT system were responsible for accounting losses for which the victims had been blamed and prosecuted.
During the latest public inquiry hearing, Simon Recaldin, who heads up the Post Office’s Horizon scandal financial redress schemes, was asked by Tim Maloney KC, representing scandal victims, whether the “serious data breach” was a “reflection of Post Office culture in any way”.
He said it was not, and blamed it on human error. “That was a genuine human error,” said Recaldin. “The Post Office is so sorry it happened, it shouldn’t have happened.”
He said it occurred during a website upgrade. “The link to the [GLO] settlement agreement, which was on the website, had broken,” said Recaldin.
“They were refreshing the link, and to do this, they had to get the original document to put in there, but they put the unredacted document rather than the redacted document in there.”
Legal discussions
A link to the document, found through a Google search at the time of writing, suggested it had been online since 2019. Recaldin said the Post Office is currently in discussions with legal advisers “to see what we need to do about that”.
During the latest Post Office Horizon scandal public inquiry hearing, Recaldin was also asked about claims that there is a culture of “over investigation” at the Post Office.
Inquiry barrister Julian Blake put the accusations to him.
Recaldin said he “shared with a passion” this viewpoint. “I truly believe it is a cultural thing,” he added. “We are in a very sensitive environment; the Post Office is shot to pieces, and therefore everyone is very sensitive and nobody wants to make a decision. For every decision they worry about the consequences of making that decision.”
Recaldin said this is understandable given “the bad place the Post Office has been in”.
He told the inquiry that in 38 years of working, 25 years of which was at NatWest Bank/Royal Bank of Scotland, managing teams of up to 1,000 people, he never had a grievance or compliant raised against him. “But I’ve worked at the Post Office for three years and I have been investigated five times,” said Recaldin.
Investigations galore
During an earlier hearing, a document titled Post Office ad hoc board report was revealed, outlining the internal investigations underway at the Post Office as of August this year.
They included Project Acer, an investigation into a manager who allegedly instructed staff to destroy material that could be of interest to the public inquiry, and Project Willow, which alleges that former transformation boss Chris Brocklesby misrepresented the off-the-shelf option to replace Horizon.
It also revealed Project Alder, an investigation into allegations that contractors working on processing subpostmaster compensation schemes were deliberately going slow to extend their contracts, and Project Phoenix, investigating whether current Post Office staff were involved in the investigations and wrongful prosecutions of subpostmasters.
Meanwhile, Project Tiger, an investigation overseen by acting CEO Neil Brocklehurst, was set up to look into complaints from former subpostmaster and campaigner Tim McCormack about the Post Office’s handling of his recent freedom of information request responses.
Outgoing CEO Nick Read has also been investigated internally, as well as former chairman Edward Staunton, who left earlier this year.
The Post Office Horizon scandal public inquiry is now in its seventh and final phase, focused on the Post Office’s current practice and procedure as well as recommendations for the future.
Computer Weekly first exposed the scandal in 2009, revealing the stories of seven subpostmasters and the problems they suffered due to Horizon accounting software, which led to the most widespread miscarriage of justice in British history (see below timeline of Computer Weekly articles about the scandal since 2009).
#Botched #Post #Office #website #upgrade #caused #data #breach