Exclusive: Glitch on website allows anyone to find out what other users have been researching, possibly compromising company mergers or investigations

This article is more than 2 years old

This article is more than 2 years old

Australia’s corporate regulator has committed a serious privacy breach via a flaw in its website that exposes the search records of anyone tapping into its company database.

The breach, which opens up free backdoor access to company search histories, including by investigative journalists and finance industry professionals, remained live on the Australian Securities and Investments Commission site on Wednesday night.

Asic was alerted to the problem 12 days ago and it is understood that its legal team has been considering a response.

Privacy concerns voiced over photo database link to real-time surveillance Read more

The breach involves a new feature on Asic’s online registry which is intended to allow users to search its database for information on companies. But the page showing the link to “Search ASIC’s registers for companies, business names, documents and more” leads to another page where anyone can retrieve details of another person’s search history simply by entering the person’s email and a date range. No other verifying information is required. It also enables them to bypass the paywall to easily download company documents the other person has paid for.

A businessman who discovered the breach was able to trace searches by Guardian journalists and employees of private equity firms that are involved in buying stockmarket-listed companies.



The businessman, who asked not to be named, said the breach opened potential for an inadvertent form of insider trading, or the use of undisclosed material information relating to public companies.

“Concerningly, we got to a few private equity firms, some people that we know are looking at acquisitions of public companies, and we can see the searches they make,” he said. “So you could in theory realise that public company X is looking at acquiring private company Y because suddenly they’re all over it.

“This has an obvious implication for investigative journalists and there’s also a potential issue with insider trading as one could look up a mergers and acquisitions department’s email addresses and retrieve companies which publicly listed entities are looking up.”

The businessman first contacted Asic about the breach on 27 October. He said he took an Asic staffer through the steps to retrieve other people’s search records and “they acknowledged this was wrong verbally”.

He had followed up four times with the regulator since, including on 3 November when “they told me their legal team are looking in to it and would contact me this week”.

Asic’s failure to close down the loophole after almost a fortnight prompted him to contact the Guardian, he said.

The Guardian confirmed user records remained compromised as of 7pm on Wednesday.

Phil Green, the Queensland privacy commissioner, said if the breach remained open 12 days after Asic was first alerted, “that’s cause for concern for people who are affected”.

“Ideally they would have acted more expediently because the risks seem high – but I don’t know all the facts,” Green told the Guardian. “The federal privacy commissioner has guidelines for good practice in this situation which seem to be applicable.”

Tim Buckley, an energy industry analyst formerly of Citibank, said it was a “ludicrous” situation and a sign of “sheer incompetence by Asic”.

Save me from Amazon’s home-delivery lunacy | Barbara Ellen Read more

He said the issue appeared to be more about a privacy breach and a potential “source of mischief” in private business than a likely trigger for illegal insider trading involving stockmarket listed companies.



The Asic register only contains unlisted companies, although “the fact someone’s looking at is a signal that might have flow-on implications for another listed company”, Buckley said. “It’s still appalling they have that loophole.”

One insolvency practitioner told the Guardian he was shocked at the breach, saying the regulator’s company search facility was used by “liquidators, lawyers, finance companies, insurance companies – everyone”.

The businessman who discovered the breach said he dealt with start-up companies, which led him to use the Asic register “all the time to make inquiries around potential acquisitions, etcetera”.

He realised there was a problem after using his email address to access Asic’s retrieve history feature, which had been introduced several months earlier.

“I thought, hang on a second – how does it know who I am?”

Neither Asic nor the office of the Australian information commissioner responded to queries.

It comes just months ahead of a new scheme that will force government agencies and businesses to report certain data breaches under the federal Privacy Act.

From 22 February, organisations will have to notify and give advice to any person who is likely to be at risk of serious harm by a data breach, as well as the information commissioner.