From Information-Security-Resources.com
Ten Most Damaging Data Breaches of 2009
Every week for the past four years the San Diego-based Privacy Rights Clearing House (PRCH), an organization dedicated to empowering consumers and protecting privacy, has been chronicling data breaches on a weekly basis.
These range from small, regional breaches, which may involve a local business or hospital, to national breaches that typically revolve around credit and debit cards.
“These are the mega-breaches that can skew the figures in terms of the number of people victimized,” says Paul Stephens, PRCH’s director of policy and advocacy.
Based on PRCH’s listings, here are the ten biggest, most damaging and most embarrassing breaches to date this year.
Heartland Payment Systems
For Heartland, a Princeton, N.J.-based payment systems company, the initial warnings came from Visa and MasterCard. Their concern: Suspicious processed credit card activity. Turns out that Heartland was the target of one of the biggest cyber-fraud schemes ever, one allegedly carried out by a former Secret Service informant and Russian hackers. Also targeted were Hannaford Brothers, 7-Eleven and two unnamed national retailers. Almost three-dozen separate lawsuits on behalf of consumers, investors, banks and credit unions have been filed against Heartland.
Number of records affected: According to the court document, hackers stole more than 130 million credit and debit card numbers from Heartland and Hannaford.
Date made public: Jan. 20
Metro Nashville School
Guess what? Your Social Security number is on Google. Or at least Metro Nashville students’ SSNs, along with their names, addresses, dates of birth and parents’ demographic information, were available via Google searches. Public Consulting Group, a private contractor, unintentionally put student data on a computer Web server that wasn’t secure, and the data was available online for three months.
Number of records affected: 18,000
Date made public: April 8
Federal Reserve Bank of New York
A former employee of the New York Fed and his brother were arrested on suspicion of obtaining loans using stolen identities. The ex-employee previously worked as an IT analyst at the bank and had access to sensitive employee information, including names, birthdates, Social Security numbers and photographs. A thumb drive attached to his computer was found to have applications for $73,000 in student loans using two stolen identities. Police also found a fake drivers license with the photo of a bank employee who wasn’t the person identified in the license.
Number of records affected: Unknown
Date made public: April 8
Virginia Department of Health Professions
“Give us $10 million, and we’ll return the millions of personal pharmaceutical records we stole from your prescription drug database.” That’s essentially what hackers told the state of Virginia in May. Did they have the goods? A notice posted on the Virginia DHP Web site acknowledged that the site “is currently experiencing technical difficulties which affect computer and e-mail systems.” Some customer identification numbers, which may have been Social Security numbers, were included, but medical histories were not. Subsequently, the state sent out notifications to 530,000 people whose prescription records may have contained SSNs. Also, 1,400 registered users of the database, mostly doctors and pharmacists, who may have provided SSNs when they registered for the program, were alerted.
Number of records affected: Potentially 531,400
Date made public: May 4
University of California, Berkeley
Hackers infiltrated Berkeley’s restricted computer databases, possibly stealing personal information of 160,000 current and former students and alumni. The university said Social Security numbers, health insurance information and non-treatment medical records dating back to 1999 were accessed. The breach was discovered April 21, when administrators performing routine maintenance identified messages left by the hackers and found that restricted electronic databases had been illegally accessed from Oct. 9, 2008 to April 6, 2009. All of the exposed databases were removed from service to prevent further attacks.
Number of records affected: 180,000
Date made public: May 9, 2009
Internal Revenue Service
Guess what the IRS does with your old tax forms? Well, at a dozen disposal facilities, old returns were tossed out in regular waste containers and dumpsters. This work was being conducted by contract employees who, of course, have access to sensitive taxpayer documents but who, the IRS admitted, may or may not have passed background checks. Another problem: the agency wasn’t sure who was supposedly responsible for overseeing the burning or shredding of tax documents at the 12 IRS offices involved.
Number of records affected: unknown
Date made public: May 21
Aetna
Current and former Aetna employees’ Social Security numbers may have been compromised as the result of a Web site data breach. This was the result of a spam campaign in which intruders obtained email address and possible SSNs from the Aetna Web site. Aetna notified the 65,000 people whose SSNs were on the site and was subsequently sued in a class action suit demanding credit monitoring, punitive damages, cost and other relief for former and potential employees.
Number of records affected: 573,000
Date made public: May 28
Network Solutions
Those damn hackers. Breaking into Web servers provided by e-commerce hosting provider Network Solutions, hackers were able to plant a rogue code that ended up compromising almost 600,000 debit and credit card accounts over a three-month interval. The hackers were able to intercept personal and financial data from customers purchasing goods and services from Network Solutions’ 4,343 clients. Most were SMBs selling online.
Number of records affected: 573,000
Date made public: July 24
National Archives
When a hard drive used for eVetRecs, the system through which veterans request copies of their health records and discharge papers, failed late last year, the National Archives and Records Administration sent it to GMRI, the contractor that sold it to the agency, to be fixed. GMRI decided it was beyond repair and sent it to another vendor to be recycled. The only problem? National Archives didn’t destroy the data on the disk before sending it out to its contractor. The drive held records on 76 million veterans, including Social Security numbers dating to 1972, when the military began using SSNs as service numbers.
Number of records affected: 76 million
Date made public: Oct. 2
Universal American Action Network
Universal Action Network, a subsidiary of Universal American Insurance, sent out postcards to 80,000 Universal clients earlier this month. The problem was that each of the cards included the Social Security numbers of the recipients. Identity theft anyone? Universal blamed the inclusion of the SSNs on a printing error and said it has terminated its contract with the printer.
Number of records affected: 80,000
Date made public: Nov. 18
* * *
Stay Informed With ISR News Alerts:
* * *
Laton McCartney is a former editor-in-chief of InformationWeek. He has also been a top editor at several Ziff Davis publications, including Smart Partner. Laton has written for The Washington Post, Fortune and other national publications. He also the author of a number of books, including the best-seller “Friends in High Places: The Bechtel Story.” His latest, “The Teapot Dome Scandal: How Big Oil Bought the Harding White House and Tried to Steal the Country“, will be published in February by Random House.
CIOZone.com is the first of its kind online meeting place for CIOs. It is built upon the foundation of social networking and combines user generated content and expert editorial together around an open source platform.The Publisher gives permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author and to Information-Security-Resources.com
