Ecuador's authorities arrest senior executive of data analytics firm Novaestrat over massive data breach

Data breach left the personal details of almost all Ecuadorian citizens exposed on the internet

Authorities in Ecuador have arrested a senior executive of data analytics firm Novaestrat in connection with the massive data breach revealed earlier this week.

The breach left the personal details of almost all Ecuadorian citizens exposed on the internet, according to the researchers from cyber security vpnMentor, who first discovered the breach on internet a few days back.

The exposed data even included information about household income.

After the news of the massive data breach broke, the government quickly announced an investigation to identify those responsible for the breach. Police raided Novaestrat's office the same day and apprehended William Roberto G., the company's legal representative, in his office. During the raid, a number of computers, electronic equipment, and storage devices were also seized.

Roberto G. was taken to the capital, Quito, for questioning.

The authorities claimed that Novaestrat, a small online data consulting firm based in the city of Esmeraldas, was not authorised to be in possession of the vast amount of data it had, adding that there was sufficient grounds to charge the company and its executives with the violation of privacy of people and disseminating personal data without authorisation.

The officials added that they were investigating how Novaestrat was able to gather such a large amount of confidential, personal data. Initial findings of the probe suggested that the company didn't hack any government server and likely gained access to the data between 2015 and 2017, when it received several government contracts.

"This is a very delicate issue that is a major concern for the government," Ecuador's interior minister, Maria Paula Romo, said in a news conference on Tuesday.

Earlier on Monday, vpnMentor revealed that its research team had discovered an unsecured database on the internet, leaking personal details of almost every Ecuadorean citizen.

The database contained comprehensive personal details, including names, dates of birth, marital status, family details and even financial information of nearly 16.6 million Ecuadorean citizens, including children.

In total, the database contained 20.8 million records, of which about 6.77 million were of children under the age of 18. The database was so comprehensive that the researchers said that they were able to find details of the country's president in it.

VpnMentor added that the database was likely populated from the Ecuadorian government's civil registry, as well as from private databases.

On Monday, Ecuador's President asked officials to fast-track a new data protection law.

In a statement, telecommunications minister Andres Michelena Ayala said that his ministry is working to finalise the draft of a new data protection law that would be submitted to the parliament in the next three days.