A database containing 337,384 records of Maltese voters’ personal information has been exposed, according to a data breach monitor.
The data includes names, addresses, ID card details and phone numbers and appears to be from the electoral register. It is no longer accessible online.
In 2017, there were 341,856 registered voters in Malta and Gozo.
Online monitoring service Under The Breach first announced the breach, tweeting on Tuesday that data had been left exposed by a Maltese IT company.
According to the monitoring service, the data was available for anyone to access without a password or any other authentication.
An online security monitoring company told Times of Malta that the company in question was C-Planet IT Solutions Ltd. The company is owned by Philip Farrugia, a former production director at One Productions, the media wing of the Labour party.
Contacted on Wednesday, C-Planet IT Solutions said it would not be replying to any questions on what it described as a mishap, insisting the data was "old".
It later issued a statement through its lawyers, saying the company had "immediately" alerted authorities "upon the notification of the alleged breach."
"In view of the latter, as you may appreciate, no further information can be divulged as it might hinder the ongoing investigations."
Data Protection Commissioner launches investigation
Ian Deguara, deputy data protection commissioner, said an investigation would be launched.
He said: "We got to know about this personal data breach this morning from media reports. We shall trigger our investigation procedure with the controller responsible for the processing to establish all the facts surrounding this security incident."
Sources told Times of Malta it appeared the company had left a 102MB database file on a server with an opened directory. The file is a backup copy of several MySQL databases, including one named "Elec_Registery".
MySQL is an open-source database management system.
Last year the Data Protection Commissioner had imposed a €5,000 fine on the Lands Authority after an investigation of a major data breach that was exposed by Times of Malta.
Correction April 1: The company in question was not identified by Under The Breach, as originally reported.