Earlier this week, it became known that a database containing 18 GB of personal data of almost all Ecuadorian citizens, including children, was freely available. In total, experts found about 20.8 million records publicly available, which exceeds the country's total population of 16.6 million. Researchers explained that this discrepancy in numbers was due to duplicates and old records that contain data about already dead people.
Experts who found an insecure server believed that the local consulting company Novaestrat, which provides data analysis, strategic marketing and software development services for the Ecuadorian market, was to blame for this data leak. As it turned out, they were right.
Government of Ecuador reacted to report what happened quickly and harshly. Thus, the Ministry of Communications and Informatization has already launched an investigation into Novaestrat. Officials believe that the company should not have owned the data it had, and now its employees have been prosecuted for allegedly violating confidentiality and disseminating personal data without permission.
The federal police have already raided the office of Novaestrat, who also served as the home of William Roberto G., CEO of the company, who was arrested and is being taken to the capital for interrogation. During the search, company equipment, data storage devices, and documentation were seized.
The Ecuadorian government is already conducting an investigation and is about to figure out how the company was able to get so much confidential information. According to officials, it is already clear that Novaestrat has not cracked any of the country's government servers. It is assumed that the data could be obtained in 2015-2017, during the previous political regime.
Let me remind you that the detected database contained data obtained from both state and private sources, including names, information about family members and relatives, data on registration of acts of civil status, financial data, as well as information about work and ownership of vehicles.
After the incident, the President of Ecuador asked to expedite the adoption of a new law on data privacy, which is designed to protect the personal data of citizens of the country. Ministry of Communications already confirmedthat will fulfill the wish of the president and submit a new law to parliament over the next three days.