U.S. tally of data breach victims tops 100M
7000
(InfoWorld) - A stolen laptop at The Boeing Co. has pushed a widely watched tally of U.S. data breach victims past the 100 million mark. On Tuesday, Boeing disclosed that files containing Social Security numbers, names and home addresses of 382,000 current and former employees were compromised in early December when an unencrypted laptop was stolen from an employee's car. That disclosure pushed the total number of data breach victims on the Privacy Rights Clearinghouse Web site to 100,152,801, said Beth Givens, director of the consumer advocacy group. Privacy Rights Clearinghouse has been tracking data breaches since February 2005, whenÂ ChoicePoint disclosedÂ that thieves had stolen information on 163,000 victims from the company's database. The ChoicePoint incident was remarkable because although the data broker was obligated to disclose the theft to victims living in California -- the only state with a beach notification law on the books -- it decided to notify everyone, Givens said. "That was the first time, to the best of our knowledge, that a breached entity decided to disclose the event to individuals nationwide," she said. "That was a watershed event," she added, "because other entities that had experienced breaches started disclosing the situation to individuals nationwide" Since the ChoicePoint incident, data security has been in the spotlight, andÂ breaches at the U.S. Department of Veteran's AffairsÂ and, most recently, Boeing and theÂ University of California-Los Angeles, have received national attention. Givens believes that the actual number of names that have been compromised since ChoicePoint is probably much higher than her tally. "I think the number 100 million is largely a fictional number, but what it really indicates is that this is a very significant problem," she said. She couldn't say whether all the publicity has made consumers any more secure. "It's quite obvious from the listing that we've compiled that we're in a very leaky boat when it comes to data security," she said. "I don't think that consumers can feel confident about the protection that their personal information receives."
680316
SACRAMENTO, Calif. -- Personal information about hundreds of thousands of retirees' may have been compromised after two security breaches involving pension funds in California and New York.
401769
More than 1,100 Commerce Department   laptop computers were lost, stolen or missing in the last five   years, and some contained personal data from the U.S. Census   Bureau, the department said.
30507
Users of a Web site operated by the U.S. government were among job seekers whose contact data was stolen by hackers who broke into computers at Monster Worldwide Inc, a U.S. government spokesman said on Thursday.
679026
A backup tape containing credit-card information from hundreds of U.S. retailers is missing, forcing the company responsible for the data to warn customers that they may become the targets of data fraud.GE Money, which manages in-store credit-card programs for the majority of U.S. retailers, first realized that the tape was missing from an Iron Mountain secure storage facility in October, said Richard Jones, a company spokesman. &quot;We were informed that one of the tapes could not be located. But at the same time, there was no record of it ever having been checked out,&quot; he said.The tape contained in-store credit-card information on 650,000 retail customers, including those of J.C. Penney, he said. GE Money employees are also affected by the breach.The missing backup tape was unencrypted.Although J.C. Penney was the only company that Jones would confirm as affected by the missing tape, that retailer accounts for just a small percentage of all accounts that were compromised. In total, 230 retailers are affected by the breach. &quot;Clearly that number includes many of the national retail organizations,&quot; he said.The tape also contained Social Security numbers of 150,000 customers. When matched with name and address information, Social Security numbers can be used to set up fraudulent credit-card accounts, a common form of identity theft.Jones said that following a GE Money investigation, there is no evidence that the tape in question has been stolen or that the data it contained was misused.After reconstructing the data that was on the missing tape, GE Money began sending out letters to those affected by the breach in December. The company has set up a toll-free number and is offering one year of free credit monitoring services to those affected by the breach.In 2006, retailer TJ Maxx discovered that thieves had&#160;broken into its computer networks, stealing an estimated 94 million credit- and debit-card numbers. Costs related to that breach are expected to be in the hundreds of millions of dollars.GE Money is a division of General Electric.
185253
(InfoWorld) - Members of the U.S. Congress introduced a flurry of new technology-related bills this week, including two bills that would require companies with data breaches to notify affected customers. Senators Patrick Leahy, a Vermont Democrat, and Bernie Sanders, a Vermont independent, introduced the Personal Data Privacy and Security Act. In addition to requiring data breach notification, the bill would also require data brokers to disclose what information they hold on individuals. The bill would allow individuals to correct information held by data brokers, and it would require companies that have databases with personal information on more than 10,000 U.S. residents to implement data privacy and security programs. Representatives Bobby Rush, a Illinois Democrat, and Cliff Stearns, a Florida Republican, introduced the Data Accountability and Trust Act this week. Their bill, with 24 co-sponsors, authorizes the U.S. Federal Trade Commission (FTC) to draw up data privacy requirements for businesses, including requirements that they have vulnerability assessments and policies for disposing of obsolete data. After a company reports a data breach, the FTC would conduct an audit of its security practices, and, like the Leahy-Sanders bill, the bill would require data brokers to disclose the information they hold on individuals and allow individuals to correct wrong information. Organizations have lost 100 million personal records belonging to U.S. residents in data breaches since 2005, Leahy said in a speech on the Senate floor. Leahy, chairman of the Senate Judiciary Committee, singled outÂ data breaches at the U.S. Department of Veterans AffairsÂ last May andÂ retailer The TJX Companies,Â announced in January, in his speech. "These data security breaches are compelling examples of why we need strong federal data privacy and security laws to protect Americansâ personal data and to address the ills of lax data security," he said. "In the information age, any company that wants to be trusted by the public must earn that trust by vigilantly protecting the databases they use and maintain." Members of Congress introduced about a dozen bills requiring data breach notification after a series of breaches in early 2005, but legislation stalled largely over committee jurisdictional wrangling. About 30 states have passed breach notification laws, most of them since 2005. The Cyber Security Industry Alliance, a trade group of IT security vendors, in January called on Congress to pass a comprehensive data protection bill, including breach notification. But some groups, including conservative think tank the Progress and Freedom Foundation, have questioned the need for a breach notification law, saying the cost to businesses may far outweigh the benefits to consumers. Other tech-related bills introduced this week: -- Two bills allowing the FTC toÂ investigate the practice of pretexting, when an investigator assumes a false identity to gain access to a person's telephone records. President George Bush signed a bill creating penalties for pretexting in January, but the two new bills would give the FTC the authority to investigate and prosecute pretexters. Many lawmakers became interested in the issue afterÂ Hewlett-Packard disclosedÂ in September that investigators it had hired used pretexting in an attempt to gain access to board members' and reporters' phone records. -- A bill targeted at spyware by establishing criminal penalties for a number of actions. The bill would prohibit keystroke logging, taking control of a computer without the user's consent, diverting Web browsers, using computers to create botnets and modifying a computer users' browser and security settings without permission. Two spyware bills passed the House of Representatives by overwhelming majorities in March 2005, but the Senate didn't act on them. Â
39337
More than 1,100 laptop computers have vanished from the Department of Commerce since 2001, including nearly 250  from the Census Bureau containing  such personal information  as names, incomes and Social Security numbers, federal officials said yesterday.
531701
AOL is facing a possible class action lawsuit over the release of search result data of 650,000 users in July. While the identities of those involved were scrambled, some of the data included within provided evidence of possible crimes.
463560
More than 3.5 million Americans were victims of phishing scams and online identity theft in the year that ended in August, a 57% increase over 2006, according to Gartner fraud analyst Avivah Litan.
536605
Computers belonging to the U.S. government, contractors and companies in the transportation industry were hit by a targeted computer attack in July that yielded password information for hundreds of Internet and intranet Web sites, a computer security vendor said Tuesday.
648868
A computer technician who prosecutors said made possible the largest identity theft in US history, surpassing $US50 million ($A71.
50197
RICHARDSON, Texas - Hackers might have obtained the personal information of 6,000 people who worked for, applied to or attended the University of Texas at Dallas, school officials said Wednesday.  The information includes names and Social Security numbers, the school said.
580178
According to Department of Homeland Security studies, the instance of identity theft and computer fraud has doubled annually since 1999, costing Americans billions of dollars.
686971
HARTFORD, Conn. - More than 1,700 state workers recently learned that some of their personal information, including their names and Social Security numbers, had been inadvertently posted on the Internet.
554027
Personal data on thousands of mostly U.S. residents were found exposed, ripe for spam and hacking.
353357
Crackdown on online fraud produces more than 100 legal actions in Europe, Middle East.
537002
Americans lost at least $548 million  to identity theft and consumer fraud last year as the Internet  provided new victims for age-old scams, according to government  statistics released Tuesday.