link

Insurance site exposes personal data Glitch on Selectquote site reveals information to next user By Mike Brunker MSNBC March 22  Consumers who requested online life insurance quotes from Selectquote.com on Tuesday and Wednesday got more than they bargained for: Thanks to a software glitch, their personal information was left on the companys Web site for the next user to see. THE PROBLEM occurred when a form that consumers fill out to request a quote failed to clear the contents at the end of the process. This left everything from the previous users name and address to information on current coverage and parents health histories plainly visible to the next person to request a quote. Lyle Griffin, a spokesman for Selectquote, said the problem occurred when programmers fixed a piece of code on the site that was causing a problem for users with an older version of Internet Explorer. Unfortunately, the fix created a problem in the quote request form, he said. The problem lasted from 4 p.m. PT on Tuesday until about 10 a.m. PT Wednesday, but it affected only about 20 users who were directed to a newly designed Selectquote site that is still being tested, Griffin said. Not to minimize it, he said of the problem. Obviously this is extremely embarrassing. MSNBC.com was alerted to the problem late Tuesday by a prospective Selectquote customer, who was outraged that other visitors to the site were able to view her personal information. About 10 minutes (after filling out the form) I got a call from a woman in Ohio who said, Im just someone whos on Selectquote and all your information is prepopulated in the questionnaire, said Ona Karasa of Bellevue, Wash. She said she went back on the site Wednesday morning and saw the information of two other people who apparently had just requested life-insurance quotes using the online service. MSNBC editors also were able to access personal information entered by other users until midmorning Wednesday. Another user, Richard Underwood of Rockville, Md., said he was alerted to the problem early Wednesday by e-mail from another Selectquote surfer. He said a company representative had called and left a message concerning his request for a quote, but did not mention the Web site problem. Truthfully, I dont know if I want to talk to anyone at Selectquote about life insurance at this point, he said. Underwood said the experience would likely make him pause the next time he is prompted to enter personal information on a Web site. I was just getting to the point where I was reasonably comfortable doing that, but I may have to think twice if this is how it works, he said.

-- abc (123@456.789), March 23, 2000

Answers

a common enough program bug, should have been noticed in testing

the web really exposes programs and thus the organisation to the entire world, its gotta be tested to destruction

-- richard (ohsirrichard@ibm.com), March 23, 2000.