 |
 |
 |
 |
 |
 |
 |
 |
 |
In The News
|
|
|
|||||||||
|
|||||||||||
|
|
|
|||||||||
|
|||||||||||
|
In The News |
|||||||||||
|
|
||||||||
|
IBM Loses personal records on Tape An outside vendor was transporting the tapes from one IBM facility to another on Feb. 23 when the tapes fell out of a contractor's vehicle in Westchester County, N.Y., not far from IBM headquarters in Armonk. IBM representatives went to the scene and couldn't find the tapes, spokesman Fred McNeese said Tuesday. The incident surfaced in recent weeks when IBM's human-resources department wrote to affected workers -- primarily former employees -- to inform them. The letter said the tapes held archival information "such as your Social Security number, your dates of employment with IBM, birth date, contact information such as your address, and your IBM work history." IBM also advertised in a local newspaper to ask for the return of the tapes. Even one backup tape likely has room for information on thousands of employees or customer accounts. McNeese would not reveal how many tapes were gone or how many employees or clients were affected. He said some of the tapes were cloaked by encryption, but not all of them. McNeese said there is no indication the information on the tapes has been exploited. But as a protection, IBM has offered a year of a credit-monitoring service to the affected employees, McNeese said. As for the customer information, McNeese said it included records of business transactions between IBM and certain clients, but he called the data "inconsequential." |
||||||||
|
Jobs lost after tapes stolen. FEBRUARY 28, 2006 In an announcement late last week, Providence Home Services, a division of Seattle-based Providence Health System, said the four workers left the company after “a confidential and thorough internal review process of the data storage procedures that led to the theft.” A
The theft took place Dec. 31, when a Providence Home Services IT department worker took backup tapes and disks home in his car as part of the home health care division’s backup protocol. The disks and tapes were stolen after they were left in the employee’s car overnight (see ”Update: Thief nabs backup data on 365,000 patients”). The division has since discontinued that backup procedure and brought in more traditional means of protecting data. Some of the data on the tapes was password-protected at the application level, while the rest of the data was stored in proprietary file formats without password protection. After the incident, the company decided to make all of its data more secure by using additional technologies, including encryption.
The health care group has also reached a deal with security vendor Kroll Inc. to provide Kroll’s ID TheftSmart credit monitoring and restoration services for free to those affected by the theft. ID TheftSmart allows individuals to continuously monitor their credit files, investigates potential identity theft cases and can help identity theft victims restore their identity if data theft occurs. Starting next week, affected patients will get a letter from Kroll detailing how to sign up for the program. “We think this will help address the concerns of our patients and their families and help put their minds at ease,” Rick Cagen, CEO of Providence Health System’s Portland Service Area, said in a statement. “We have heard from patients that the process to notify the credit agencies can be difficult, and we appreciate the time they have spent as a result of the theft.” The data theft incident is under investigation by the
|
||||||||
|
Iron Mountain Admits Tape Loss, Recommends Encryption In a move that could fuel efforts to change data storage practices, records management giant Iron Mountain has admitted losing a customer's backup tapes and is recommending that customers begin encrypting tapes. "Iron Mountain performs upwards of five million pickups and deliveries of backup tapes each year, with greater than 99.999% reliability," the company said in a statement Thursday. "Nevertheless, since the beginning of the year, four events of human error at Iron Mountain resulted in the loss of a customer's computer backup tapes. While four losses is not a large number in comparison to an annual rate of five million transportation events, any loss is important to customers and to Iron Mountain." Iron Mountain did not name the customer, but the admission comes on the heels of announcements from Bank of America and Ameritrade that the financial firms had lost backup tapes containing customer data and were notifying customers. "Iron Mountain is advising its customers that current, commonly used disaster recovery processes do not address increased requirements for protecting personal information from inadvertent disclosure," the company said. Companies commonly create multiple copies of their computer data on backup tapes and move them off site to allow for recovery in case of a disaster. According to a recent report from the Enterprise Strategy Group, only seven percent of businesses encrypt all of their backup tapes. Many businesses don't encrypt because the process increases the complexity of the backup process and may reduce the reliability of an effective disaster recovery plan, Iron Mountain said. "Iron Mountain, therefore, is recommending that companies encrypt backup tapes containing personal information, but take care to incorporate encryption in a way that does not compromise their overall disaster recovery plans," the company said. "This announcement is the beginning of a campaign to educate our customers on these important issues so that together we can start to work toward solutions." Iron Mountain noted that the accidental loss of backup tapes "poses a potential risk if sensitive information stored on those tapes is unencrypted. ... Iron Mountain is not aware of any incident in which the physical loss of a backup tape resulted in the unauthorized access of personal information. It is important to understand that unencrypted information stored on backup tapes is difficult to read, but it is not impossible. Companies need to reassess their backup strategies and seriously consider encrypting sensitive data to prevent a potential breach of privacy." "We invest more in training, automation and process controls than anyone in our industry," stated Iron Mountain CEO Richard Reese. "But even Iron Mountain is not immune from human error. The only effective means to prevent unauthorized access to data is the use of encryption." Iron Mountain spokesperson Melissa Burman said the company made the announcement "to create awareness and educate our customers on this issue. We believe encryption is the best way for businesses to meet the increasing need for privacy protection." The company isn't currently working with storage security vendors or offering an encryption solution, she said. "For now, we're focused on the education component, but we are evaluating solutions to bring to our customers, either directly or indirectly, that will make it easier for them to implement encryption into the tape backup process without compromising disaster recovery objectives," Burman told Enterprise Storage Forum.
|
||||||||
DISUK expands in
|
||||||||
| Cablevision: Employee Data Lost
Multichannel News July 7th 2006 Cablevision Systems said late Tuesday that an external vendor it hired to deliver a package containing computer tapes with the personal information of some of its current and former employees lost that information in transit. While we have no evidence to date to suggest that the tape has been accessed or misused, we are providing current and former employees with resources to monitor their credit as we continue to work with law enforcement, the courier and our 401(k) vendor to thoroughly investigate and resolve this matter," Cablevision added, declining further comment. Copyright The Associated Press 2006. All Rights Reserved |
||||||||
|
Bank of America: 1.2 million accounts jeopardized February 25, 2005 CNN Firm says tapes containing information about government cardholders, including U.S. senators, went missing. NEW YORK (CNN/Money) - Bank of America said Friday it lost computer tapes containing account information on 1.2 million federal employee credit cards, among them those of U.S. senators, potentially exposing them to theft or hacking. The bank told CNN/Money that federal government's General Services Administration (GSA) cardholders' account information may have been on the tapes. The tapes were lost in December, but a bank spokeswoman told Reuters that bank officials were not allowed to notify cardholders until they received permission from federal law enforcement authorities The missing tapes may contain information, including cardholders' names, addresses and social security numbers. But it varies from account to account. According to Time.com, which cited an unnamed U.S. official, a large percentage of the accounts are for the Pentagon, in addition to 40 federal agencies and other entities. Sen. Charles Schumer, a New York Democrat, told Reuters that he had been informed by the Senate Rules Committee that the data tapes were likely stolen off a commercial plane by baggage handlers. "Whether it is identity theft, terrorism or other theft, in this new and complicated world baggage handlers should have background checks and more care should be taken for who is hired for these increasingly sensitive positions," he added. Bank of America declined to reveal how many GSA accounts they handle but a spokeswoman said federal law enforcement is investigating the loss. The financial giant said it has sent out a letter to inform its GSA cardholders whose information may have been on the tapes. "So far no evidence to suggest the tapes have been accessed or misused," said Eloise Hale, spokeswoman for Bank of America. "The tapes are now presumed lost." |
||||||||
| Loan records vanish 1.3 million files include Texas students' names, Social Security numbers AUSTIN – Don't breathe easy just because your student loans are long paid off: Names and Social Security numbers from accounts closed more than a decade ago were among at least 1.3 million records recently lost by a computer contractor for the Texas student loan company. The Texas Guaranteed Student Loan Corp., created in 1979, urged anybody who has ever borrowed through the agency to verify whether his or her records were among those on an unspecified piece of computer equipment that disappeared May 24. I think anybody who has concerns should go ahead and contact our call center," spokeswoman Kristin Boyer said. The toll-free number is 1-800-530-0626. The corporation has also set up a Web site instructing affected individuals how best to prevent identity theft if the missing information falls into criminal hands. Go to www.tgslc.org and click on "Customer Data." The nonprofit corporation, created by the Legislature to administer federal student loan programs, answers to lawmakers and a board made up of the state comptroller and 11 members appointed by the governor. Governor Perry is concerned about the compromise of personal data and expects the agency to take swift action to rectify the problem and prevent future incidents," Perry spokeswoman Rachael Novier said. The Round Rock-based loan corporation said in its press release that all of its security procedures were followed and that the data was decrypted and left unsecured only while in the possession of the contractor, Toronto-based Hummingbird Ltd. Both companies were purposely vague about the circumstances of the breach, declining to release information about the nature of the "device" containing the data, the city in which it was lost or the circumstances of the loss. "We don't want to create a scavenger hunt by those that would abuse the data," Ms. Boyer said. "As of now, we have no indication that this data has been accessed." This much was reported by the loan corporation and Hummingbird, which was working on a data management project: In January, the loan corporation prepared and encrypted a series of files containing the sensitive information. Sometime after that, those files were downloaded by a Hummingbird employee, who decrypted them and stored them on some sort of device that was "subsequently lost." That device is password-protected, Hummingbird said. A spokesman for Hummingbird declined to expand on a news release in which the company said it "has no reason to believe that the piece of equipment has been stolen to gain access to confidential data." "Given the technology that would be required to retrieve the data, Hummingbird believes that any misuse of the data is extremely unlikely," the release said. "However, Hummingbird has exhausted every possibility to recover the equipment and has filed a lost property report with the police." That police report could not be located because the companies declined to identify which of Hummingbird's offices around the world was involved. Ms. Boyer said it was one of the firm's nine U.S. locations, which include a Dallas office. There might be fewer than 1.3 million people affected by the breach because some of the records are likely duplicates of borrowers with more than one loan, Ms. Boyer said. The current estimate of missing records represents about 10 percent of the company's borrowers. The number might rise, she said, because the companies are still working to identify which files were on the missing apparatus. Because of that, the loan company said it is important for clients to call in and update their addresses so they can be notified if the companies learn more about which records were affected or if the case is solved. E-mail pslover@dallasnews.com |
||||||||
| Two IT execs at Ohio University fired after data breaches The personal data on thousands of students was exposed Todd R. Weiss August 04, 2006 (Computerworld) Two top IT officials at Ohio University (OU) who were suspended in June in connection with data security breaches at the school in recent months were fired yesterday. The initiatives are expected to cost between $5.5 million and $8 million. The changes at OU follow a review of an independent report commissioned to assess the university's IT security practices. The first breach involved a server containing patent data and intellectual property files at the university's Innovation Center. That breach was discovered when the FBI told the university it had been provided with disk drives from the server. A few days later, IT officials noticed that a server supporting alumni relations and development had been compromised and was being used to launch distributed denial-of-service attacks against an external target. That breach -- which had remained undiscovered for more than a year -- prompted the university to notify alumni of the potential compromise of their Social Security numbers and other personal data. |
||||||||
