Confidential data left on old PCs

Highly-sensitive information such as passwords and user names of company executives has been found on used computer disk drives bought on eBay.

Researchers at the University of Glamorgan analysed some 100 randomly-sourced PC hard disks, and discovered that more than half contained data from organisations such as multinational companies, universities and a primary school.

Data on the disks included:

* staff records, passwords, internal emails and financial details

* school reports, a list of pupils, and letters to parents

* a document template for university degree certificates.

Attempts had been made to destroy data on nearly half the disks in the study, but significant material remained intact.

'On at least seven of the disks that I have seen there was enough information to allow a hacker to get into an organisation,' said Dr Andy Jones, security research group leader for BT Exact, who examined the disks.

The government issues guidelines to businesses and public bodies on the proper disposal of computer equipment, much of it freely available online.

But the University of Glamorgan research, seen exclusively by Computing, suggests that even the most diligent organisations can still be affected.

Information from Swedish insurance company Skandia was uncovered, even though the firm invests in data destruction. 'This is not embarrassing for us, it's absolutely horrifying,' said a Skandia spokeswoman.

'We pay to have our data wiped thoroughly, so we are going to have to investigate to discover how it happened and make sure it does not happen in the future.'

Southampton University says it has launched an investigation, after passwords and staff emails were discovered by the research. The university uses a specialist company to wipe disks before disposal of equipment.

'We need to find out what happened and ensure it doesn't happen again,' said a spokeswoman.

Agrochemicals company Monsanto says it will investigate how details of crop research from its Cambridge offices was found.

'We assume this is an isolated incident which has arisen during the restructuring of our Cambridge offices, when a number of IT items were disposed of at the end of their working lives,' said a spokesman. 'It seems a serious lapse in our procedures for the disposal of surplus IT kit has occurred.'

Computing has requested that all disks and data recovered by the University of Glamorgan research are returned to their original owners or destroyed.