Nearly 6,000 people hit by data breach after York council app hacked

The council was contacted by a hacker who said they had found a way to access personal data, including phone numbers, encrypted passwords and addresses, of residents using the One Planet York app.

A letter sent to users of the app says the council is not sure what the hackers have done with the data.

And a council spokesman said the incident has been reported to North Yorkshire Police.

The letter says: “We value your privacy and deeply regret this incident occurred. We have conducted a thorough review of the One Planet York app, we have deleted all links with the app and as a result, will no longer support it going forward.

“We have deleted it from our website and asked for it to be removed from the app stores and ask that you now delete it from your device.

“We cannot say for certain what the third party responsible has done with the data.”

A council spokesman said 5,994 records are contained in the app and could have been breached.

Ian Floyd, deputy chief executive at the council, said: “On November 1, 2018, a third party contacted the council and told us they had found a way to access personal data of those people who use the One Planet York app.

“The data accessed included personal information such as names, addresses, postcodes, email addresses and telephone numbers together with encrypted passwords.

“To our knowledge, the data accessed did not include any further sensitive information. In addition, the One Planet York is isolated from other council systems and therefore unable to access other personal data.”

The letter added that the hackers did not request anything in return for the personal data and says this suggests they are “someone who looks for data vulnerabilities in the public interest”.

The One Planet York app enabled users to check their bin collection dates, whether packaging was recyclable and the location of recycling points.

App users are advised to delete the app and change their passwords.