Hosting provider UKFast claims to have uncovered serious data leaks from several local councils using Google search.
The firm claims one unnamed council posted supplier contact and pricing information online, along with details about its 83 million annual spend.
In a statement, Lawrence Jones, chief executive at UKFast, said: "The public sector should set an example on data protection so to discover such a lapse where personal details and sensitive data is openly available from a local government body is very concerning."
It would be unethical to disclose this information without advising the council involved.
However, it is difficult to discern in this case whether a data breach has occurred or if the data has been posted online for transparency purposes.
A spokesperson for the Information Commissioner's Office (ICO) told IT Pro: "Proactively making financial information available can not only help to retain public trust, but save time as they will no longer have to deal with information requests for this data.
"With the limited information available, it is difficult to determine whether the information relating to the council's annual spend was released proactively or was the result of a security breach."
Speaking to IT Pro, UKFast's director of data centres, Stuart Coulson, declined to identify the council involved.
"It would be unethical to disclose this information without advising the council involved," said Coulson.
"However, this is not an isolated incident and during our research we found further cases of full supplier data [being] exposed. We do need to recognise that this kind of data is valuable to unscrupulous parties."
Coulson said he doubted the information had been leaked maliciously, but said it still constitutes a "basic oversight in data security."
"Public sector bodies should set an example in security awareness by demonstrating more sophisticated data protection practices," he added.
It was not just council data UKFast uncovered, Coulson claimed.
"This research also discovered security failures amongst private businesses that were found to have left customers' personal information, including credit card details, unencrypted and searchable by Google," he said.
"The investigation followed up on a similar study 12 months ago and highlights the lack of progress in raising cyber security awareness, despite high profile hacks [involving] Sony, LinkedIn and Yahoo in the last year."
-
AI is helping bad bots take over the internetNews Automated bot traffic has surpassed human activity for the first time in a decade, according to Imperva
-
Two years on from its Series B round, Hack the Box is targeting further growthNews Hack the Box has grown significantly in the last two years, and it shows no signs of slowing down
-
AI recruitment tools are still a privacy nightmare – here's how the ICO plans to crack down on misuseNews The ICO has issued guidance for recruiters and AI developers after finding that many are mishandling data
-
“You must do better”: Information Commissioner John Edwards calls on firms to beef up support for data breach victimsNews Companies need to treat victims with swift, practical action, according to the ICO
-
LinkedIn backtracks on AI training rules after user backlashNews UK-based LinkedIn users will now get the same protections as those elsewhere in Europe
-
UK's data protection watchdog deepens cooperation with National Crime AgencyNews The two bodies want to improve the support given to organizations experiencing cyber attacks and ransomware recovery
-
ICO slams Electoral Commission over security failuresNews The Electoral Commission has been reprimanded for poor security practices, including a failure to install security updates and weak password policies
-
Disgruntled ex-employees are using ‘weaponized’ data subject access requests to pester firmsNews Some disgruntled staff are using DSARs as a means to pressure former employers into a financial settlement
-
ICO reprimands Coventry school over repeated data protection failuresNews The ICO said the academy trust failed to follow previous guidance, which caused a serious data breach
-
ICO dishes out fine to HelloFresh for marketing spam campaignNews HelloFresh failed to offer proper opt-outs, the ICO said, and customers weren’t warned their data would be used for months after they cancelled
