Corporate data slips out via Google calendar

Sensitive data from companies like McKinsey and JPMorgan Chase can be found using Google Calendar Search

It's not clear what gets discussed during McKinsey & Co.'s weekly internal communication meeting, but the dial-in number and passcode for the event can be easily found by searching with Google.

The data is out there thanks to the Search Google Calendar a feature added to Google's Web-based calendar service last November. Google bills it as a cool way to discover interesting events, but a few quick searches show that it can also be used to turn up sensitive corporate information that was inadvertently made public using Google Calendar.

Launched last year as part of Google's effort to develop a series of Web-based productivity applications, Google Calendar gives users the choice of keeping calendar entries private or publishing them for the world to see, but some Google Calendar users appear to be sharing their calendar information without realizing it. The McKinsey dial-in information, for example, was posted by a single person who had shared a number of calendar events including project status meetings and call in numbers for the company's "McKwiki Weekly," project.

McKinsey spokesman Mitch Kent confirmed that the name on the Google Calendar matched that of a McKinsey employee in the company's IT department. McKinsey employees do not "use Google calendar on a regular basis," he added.

Further searching revealed that quite a few corporate calendars can be found on Google Calendar yielding such tidbits as the date and time of vendor meetings and names of projects in the works. Dial information could also be seen Tuesday on other calendars for calls on topics such as "Deloitte's V2 Status Meeting- Updated" and "Compliance Overview."

Details for several JPMorgan Chase & Co. conference calls relating to the company's storage systems, including a dial-in number and passcode for a May 3 call to discuss a "SAN Security Remediation Project," also could be seen publicly. The Google Calendar user who posted the JPMorgan information could not be reached for comment.

"This is pretty much exactly the kind of recon necessary to start doing industrial espionage," wrote Robert Hansen, the CEO of Sectheory.com, when he first blogged about this issue on Tuesday. "Weekly meetings that discuss key internal information? Not looking good. Sometimes you see major leaks in the least likely places."

This kind of data leakage is a growing problem for corporations, whose employees are adopting a new generation of Web-based productivity tools without necessarily understanding the security implications, said Marv Goldschmitt, vice president of business development with data auditing appliance vendor Tizor Systems Inc. "People may not understand what it means to put their information on a public service."

Google Calendar gives users three way of publishing calendar entries: "Default," "private," and "public." But the company needs to make it very clear to users when they are posting information to the public, or face the risk of being blamed for its users' mistakes.

This could happen if news of a corporate acquisition were leaked via Google Calendar, he said. "That would have been a case of misuse by the user, but is the public going to read it as that, or are they going to read it as now they don't trust Google?"

Google representatives did not immediately respond to requests for comment.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?