The bank details of 17,000 Australian businesses have been harvested from a Treasury department Web site, with many companies finding their details contained in an alarming e-mail, this morning.
A man calling himself 'Kelly' rang ABC radio station 2BL this morning claiming he had accessed company details from the GST information site www.gstassist.gov.au, which contains the details of about 27,000 businesses.
He said there was no security at the site, and that he simply used a CGI script, inserting numbers between 1 and 27,000 to retrieve records of registered GST Startup certificate suppliers. These are companies that can honour a $200 GST-related rebate on computers, software, services and other items required for small and medium companies to prepare for Australia's new taxation system.
"They didn't have any security. There was none. There was no cracking involved. It was more of a discovery. When I noticed it I was concerned. I didn't want it to be covered up," Kelly told ABC Radio.
He said he used a macro to send messages to 17,000 of the companies listed telling them that the site's security was non-existent. He stopped at 17,000 when the site was disabled at about 8am this morning.
In each e-mail Kelly included businesses names, addresses, phone fax and email details and full bank account details. He said he only sent each entity's details to themselves, no-one else and that "I haven't even looked at them myself", he said.
"I was confirming that the hole was there and I entered my own details. Any one could have entered in a number at the top and got account details."
The Treasury department is expected to release a formal statement at 10 am, declining to comment until then.
