INM confirms Buckley's role in alleged data breach
Independent News & Media plc (INM) has written to people who may have had their data searched in an alleged major data breach at the media publisher.
The letters confirm that IT back-up tapes containing emails and other digital files was provided to a third party service provider on the instruction of the company’s former chairman Leslie Buckley.
It is understood letters have been issued to all 19 people who appeared on a “persons of interest” list discovered by the Office of the Director of Corporate Enforcement (ODCE) during a year-long investigation into a range of corporate governance issues at the company.
These included journalists, former INM staff and directors, as well as barristers and people working in public relations and strategic communications.
High-profile names on the list include journalist and television presenter Brendan O’Connor, who is deputy editor of the Sunday Independent, and Moriarty Tribunal barristers Jerry Healy SC and Jacqueline O’Brien SC.
According to a copy of one of the letters, seen by Independent.ie, the company said it had received new information suggesting the possibility data relating to them held on INM’s servers in 2014 was “put at risk of inappropriate disclosure as a result of a data security incident”.
The letter said INM was informed of this by the ODCE on March 23.
“The context in which the risk of inappropriate disclosure occurred was that in 2014 a number of INM’s back-up tapes (containing back-up copies of electronic data, such as emails to and from INM email addresses and digital files, stored on INM’s servers as at 2014) were provided to a third party service provider on the instruction of the then-chairman of INM,” the letters stated.
“The INM board only became aware of this incident in August 2017 and promptly notified the Data Protection Commissioner of the matter at that time.”
The letters said that prior to the correspondence from the ODCE, it had understood from persons directly involved in the exercise that the data recorded on the back-up tapes was restored and searched for the specific purpose of finding details regarding a particular long-term professional services contract between INM and a service supplier.
It said the ODCE correspondence suggested the data may have been “searched more extensively and for a different purpose”.
“In particular, the material provided by the ODCE include a list of names of ‘additional users/persons of interest’, including your name,” the letter said.
“This suggests that the data recorded on these back-up tapes may also have been restored and searched for communications including reference to you.
“INM does not know whether any such searches were in fact undertaken or for what purpose, but based on the limited information currently available to INM it seems possible that they were.
“INM also does not know to whom any results of any such searches might have been provided.”
The letter said the company was taking the matters very seriously and was taking practical steps to establish whether searches against individuals named on the list were in fact undertaken, and, if so, for what purpose and to what use they were put.
It said INM investigated the matter upon the INM board becoming aware of it in August 2017.
The letter said the board was informed that the back-up tapes concerned were recovered from the third-party contractor in December 2014.
“In August 2017, INM sought an account of operations performed on the INM data concerned. The board was informed no copies of the data were retained,” it said.
The letter said the company was cooperating with the Office of the Data Protection Commissioner.
According to the ODCE a so-called “data interrogation” was directed by Mr Buckley and invoices associated with it were discharged by a company owned by its largest shareholder, businessman Denis O’Brien, the State’s corporate watchdog has alleged.
Mr Buckley has said he will robustly defend his position, while Mr O’Brien has yet to comment.