Suprema, the biometric and security technology provider that had more than one million fingerprint records accessed by researchers last week, has released a statement downplaying the breach.
The Korea-based firm’s BioStar 2 security platform holds biometric data, such as fingerprints and voice data, of those who require access to secure facilities. The Guardian reported that this included the UK’s Metropolitan Police force, as well as financial institutions.
Go deeper with GlobalData
The researchers said they also found facial recognition data, names, addresses, passwords, employment history and logs of access to secure buildings in the breach.
Six days after Israeli security researchers Noam Rotem and Ran Locar, along with privacy site VPNMentor, discovered that Suprema’s BioStar 2 web-based security platform had left its database unprotected and mostly unencrypted, Suprema said that there is currently no indication that the biometric data was downloaded.
“Last week, we were made aware that some BioStar 2 customer user data was accessed by third-party security researchers without authorisation for a limited period of time,” the company said in a statement.
“There are no indications that the data was downloaded during the incident based on the investigation to date.”
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataResearcher questions Suprema statement
Suprema also said that only a small number of its customers using the BioStar 2 platform were affected.
“This incident relates to a limited number of BioStar 2 Cloud API users and does not affect Suprema’s other clients, users or data. The vast majority of Suprema customers do not use BioStar 2 Cloud API in their access control and time management solutions.”
The security company added that it has launched an internal investigation and that it “immediately closed the access point” that the researchers used to demonstrate the security flaw.
It has also brought in a “leading global forensics firm to conduct an in-depth investigation into the incident”.
The forensic firm’s investigation so far has confirmed that “no further access has occurred, and that the scope of potentially affected users is significantly less than recent public speculation”.
However, Rotem told Verdict that in his opinion “this response is not serious”, questioning the preliminary findings of the external forensics team.
“They never asked us where we accessed the data from, so they cannot know who accessed it,” he said. “We always take the trouble of accessing these systems from at least two separate countries exactly for this purpose. The fact that they never reached out to us shows that they are not serious about finding out the scope of the leak.”
Nevertheless, Rotem said that it’s “possible” they traced the leak “if they had access to the servers”, adding that “there are logs for each incoming request – it’s part of the protocol for any incident response team”.
In doing so, they would “know from which IP addresses the data was accessed, and not necessarily the identity of the people who accessed it. But at least they’d have a number to know how many people accessed it, when, and what did they do”.
The researchers said that in total, they had access to over 27.8m records, or 23 gigabytes-worth of data.
Suprema added that it is in the process of notifying companies who may have been affected by the breach, as well as “engaging the relevant authorities and regulators”.
Last week the Information Commissioner’s Office, the UK’s data regulator, said it was “aware of media reports in relation to this matter and we will be making enquiries”.
Read more: Suprema data breach: What GDPR says about biometrics
