Let's compare gaping holes in the security of comparison websites...
Get a quote from a price-comparison website and you might as well just start you own blog filled with loads of your personal information, then go on The One Show and tell Jason and Alex all about it. Those are more or less the findings of the dudes and dudettes at PC Pro, who have discovered just how easy it is to access the personal details of customers of Confused.com and Comparethemarket.com.
With Comparethemarket.com, PC Pro found that all they had to do to access the entire quote history of a customer was to input their email address, surname and date of birth. None of which is particularly hard to find, especially in the era of social networking where people are happy to sleepwalk their way into offering up so much of their private info.
By inputting those three simple pieces of information, a whole heap more was available - telephone numbers, car registration and make details, occupation, personal details of spouses as well as property details where house insurance quotes were available. Staggering stuff, and an identity thief’s dream come true.
When it came to Confused.com, PC Pro say that all that was required was to fill in a web form to reset the account-holder’s password before gaining access to quote history and further personal information. They said that any hacked account holder wouldn’t even know that someone had been sniffing aroung in their data as no email confirming the password change was dispatched.
PC Pro say that they have contacted both Confused.com and Comparethemarket.com but at the time of publishing the story earlier today, neither company had tightened up the security on their sites. Confused.com did say: "We take our customers' data protection seriously. We are currently in the process of upgrading our password reset and retrieval methods to enhance security for our customers including use of additional security questions, and this will be available in the near future."
The moral of the story – don’t buy your car insurance off an up-his-own-arse meerkat.