The data of Sberbank and VTB clients has become publicly available

Less than two weeks after the scandal with Google Docs in the search results of Yandex, a new leak was discovered. It turned out that in the issuance of a search engine, you can also find personal data of some users of Sberbank, VTB, the unified transport portal of the Moscow government and online stores.

• to the fact that the data of clients of the largest Russian Internet services (up to high-resolution scans of passports) can be found in search results , drew attention Pavel Medvedev, a search engine optimization specialist about how this could happen . He wrote a detailed article .
• In a nutshell: as in the case of Google Docs, the greatest risk of leakage is in those closed pages that the service shows the user not with a password, but in the form of a unique secret link with a long address from a random set of characters. It is impossible to pick up such an address even with the help of specialized software - but in the absence of the necessary precautions, the search engine can index it. This does not even require the user to forward the link to someone or publish it in the public domain - many plug-ins for Google Chrome and Yandex browser browsers (they account for 70% of the market) quite legally collect information about the pages visited by the user and can pass information about them to the search engine for indexing. According to one of the main versions, this is how closed Google Docs got into the Yandex search results.
• The main fault in the leak lies with the services themselves, as rightly pointed out in its comment Yandex : it would not be able to index pages with personal data if their domains had a robots.txt file that specifies access restrictions for search robots. This is “neglect of elementary data protection requirements,” Pavel Medvedev states in his article. Sberbank promised to conduct an internal investigation into the fact.

What do I get from this?

Unfortunately, there is no way to protect yourself from "neglect of elementary data protection requirements" on the side of the Internet service - especially considering that it was allowed by the largest companies. But you can reduce the possibility of such a leak - for this you need to check all your browser plug-ins, carefully read the user agreements and, wherever possible, disable the possibility of collecting data for indexing by search engines. Besides, now that you're dealing with a private document accessible through a secret link, you're at least warned.