..:: Security Active ::..

Personal data including the signatures of recipients has been exposed to those tracking deliveries on the Parcelforce website, the BBC has discovered.

A failure in the system allowed people using the mail tracing service access to the name, postcode and signature of various addressees.

The breakdown put Parcelforce at risk of breaching data protection rules.

The delivery service, part of the Royal Mail Group, apologised. It said the problem had been resolved.

Fail track

Customers sending a package with Parcelforce Worldwide are given a reference number which allows them to track the progress of the delivery.

However, when the BBC News website entered reference numbers into the "track and trace" feature on the Parcelforce website, a series of unconnected deliveries was revealed.

Although the same reference number was typed in, the specifics of parcels with other reference details were displayed.

Within the space of 30 minutes, the system handed out details of parcels in Cleveland, Swansea and even awaiting customs clearance en route from Shanghai.

These included some parcels that had already been delivered. On the page declaring "proof of delivery", the name and postcode at its destination were shown, alongside a reproduction of the signature of the recipient.

Such information would give an identity fraudster easy access to people's names, addresses and signatures.

During the BBC's investigations, we saw the details of Linda Mitchell, of Farnham in Surrey, and the signature of her mother who signed for the parcel.

Mrs Mitchell noticed a problem when she entered the reference number on the website and it said her parcel was in Glasgow, then Coventry.

"The more you think about it, the more you wonder what is going on," she said.

And BBC News website reader Steve Davis, of Twickenham, said he was left confused by the tracking service fault.

"I thought that the bike I had been waiting for all week had been delivered and accepted in Germany," he said.

A large internet service provider said data for as many as 100,000 websites was destroyed by attackers who targeted a zero-day vulnerability in a widely-used virtualization application.

Technicians at UK-based Vaserv.com were still scrambling to recover data on Monday evening UK time, more than 24 hours after unknown hackers were able to gain root access to the company's system, Rus Foster, the company's director told The Register. He said the attackers were able to penetrate his servers by exploiting a critical vulnerability in HyperVM, a virtualization application made by a company called LXLabs.

Foster said he's been unable to reach anyone at LXLabs to discuss the suspected vulnerability. The Register has also received no response to inquiries sent to the company, which according to its website is located in Bangalore.

According to Foster, data for about half of the websites hosted on Vaserv was destroyed all at once sometime Sunday evening, shortly after administrators noticed "strangeness" on the system. The attackers had the ability to execute sensitive Unix commands on the system, including "rm -rf," which forces a recursive delete of all files.

Some 50 percent of Vaserv's customers signed up for unmanaged service, which doesn't include data backup, Foster said. It remains unclear of those website owners will ever be able to retrieve their lost data, he said. As a result, at least half the websites that were hosted on the site remain offline.

"Since last night, I've had probably 40 phone calls from clients saying 'Why is my website down,'" said Daniel Voyce, a web developer for Nu Order Webs who uses Vaserv to host customer sites. "It's making me look bad."

Voyce said the hackers, given the high level of server access they gained, were likely able to intercept a wealth of sensitive data stored on Vaserv's servers. Voyce said his customers are safe because all sensitive information was encrypted.