Back on Christmas Eve of last year there were some reports that Elon Musk was in the process of shutting down Twitter’s Sacramento data center. In that article, a number of ex-Twitter employees wer…
It’s effectively a case of “I left my house unlocked and unarmed while I went on vacation. No one broke in, so I don’t see the point in door locks and alarm systems.”
Twitter got very VERY lucky that the worst that happened was some outages.
They moved hyper sensitive user data in a moving truck. If anything had gone wrong they would’ve exposed millions of peoples sensitive data.
You are supposed to wipe the servers before you move them, you shouldn’t be driving servers around on the highway while they are still chock full of peoples credit card info and shit.
We don’t know what was on those servers, but it was apparently sensitive enough that the government redacted descriptions of the data in court filings.
The US government brief said the relocated servers were not wiped before being moved to a new data center. The type of data on the relocated servers was apparently so sensitive that it could not be described in the US court filing, which redacts the sentence that describes what the servers contained.
Isn’t all of it encrypted though? Like I understand physical access to servers is generally bad, but you’d think once the the things are unplugged it would be difficult to access the data again without bypassing encryption. I’m not a software engineer though
BS, I don’t know if Twitter holds credit card data, but if they did, they would have needed to abide by PCI DSS rules, which requires encrypting the data in special hardware security modules.
So no, moving those servers wouldn’t put the data at risk.
Personally identifiable information (PII) is any set of data that has a chance to uniquely identify a person, including name, address, credit card info, social security, etc. It can also include things like birthdate, city, IP address, and so on, depending on how the combination of data works. The general rule of thumb is that you want to aggregate out to the city level at least, or completely anonymize the data. These, I’m supposing, we’re raw records that contained account info.
