[ISN] PC World sells "new" hard drive with personal data on

[InfoSec News]

http://www.theinquirer.net/?article=16938

By Mike Magee
30 June 2004

A WESTERN DIGITAL hard drive sold as new in a major PC World outlet in
London on Monday contained a couple's personal data including
spreadsheets, VAT information and other sensitive information.

We bought the Western Digital 20GB Caviar drive along with a CD drive
from the Tottenham Court Road branch of PC World because we were
building a new PC.

But after the operating system software failed to install correctly,
we examined the hard drive and found that it contained a number of
Word documents and Excel wordsheets belonging to an individual and his
partner, based in West London.

The package was sold intact with a black and white security label
saying "do not open before purchase", and was for sale with other new
drives in the superstore.

A representative for PC World said she was puzzled at how the incident
could have occurred.

She thought there were a couple of possibilities. Those were - that
the drive was received in that condition from the manufacturer, or
that the disk was returned by a customer as new and unused.

She said that if the disk had been returned as defective it would have
been returned to the warehouse. The Dixons Group has a returns policy
where defective products go back to the manufacturer for replacement.

The odds against an itinerant IT hack coming into the shop and picking
up a drive like this must be pretty big. Wish we had the same luck on
the nags or the lottery.