Monster defends delay in notifying users of data breach
398395
Online job service is taking steps to prevent further attacks on its databases.
679026
A backup tape containing credit-card information from hundreds of U.S. retailers is missing, forcing the company responsible for the data to warn customers that they may become the targets of data fraud.GE Money, which manages in-store credit-card programs for the majority of U.S. retailers, first realized that the tape was missing from an Iron Mountain secure storage facility in October, said Richard Jones, a company spokesman. &quot;We were informed that one of the tapes could not be located. But at the same time, there was no record of it ever having been checked out,&quot; he said.The tape contained in-store credit-card information on 650,000 retail customers, including those of J.C. Penney, he said. GE Money employees are also affected by the breach.The missing backup tape was unencrypted.Although J.C. Penney was the only company that Jones would confirm as affected by the missing tape, that retailer accounts for just a small percentage of all accounts that were compromised. In total, 230 retailers are affected by the breach. &quot;Clearly that number includes many of the national retail organizations,&quot; he said.The tape also contained Social Security numbers of 150,000 customers. When matched with name and address information, Social Security numbers can be used to set up fraudulent credit-card accounts, a common form of identity theft.Jones said that following a GE Money investigation, there is no evidence that the tape in question has been stolen or that the data it contained was misused.After reconstructing the data that was on the missing tape, GE Money began sending out letters to those affected by the breach in December. The company has set up a toll-free number and is offering one year of free credit monitoring services to those affected by the breach.In 2006, retailer TJ Maxx discovered that thieves had&#160;broken into its computer networks, stealing an estimated 94 million credit- and debit-card numbers. Costs related to that breach are expected to be in the hundreds of millions of dollars.GE Money is a division of General Electric.
760460
Few companies know as well as ChoicePoint the consequences of failing to secure the personal information of consumers.
427538
Deadline for federal agencies' policies for dealing with data breaches approaches and it's not yet clear whether everyone will be done in time.
114943
(InfoWorld) - Google has decided to make the data it stores about end-users anonymous in its server logs after 18 months, according to a blog posted Monday by the company's global privacy counsel. Previously, Google had said it would make the data anonymous after 18 to 24 months. The decision comes in response to a letter the company received last month from a European Union data protection working group regarding Google's privacy policies. Separately, a report released last week by Privacy International ranked Google worse than any other Internet company in protecting the privacy of its users. In its letter, the Article 29 Working Party, an advisory panel of representatives from the E.U.'s national data protection authorities, asked Google to explain why it needed to keep user data for 18 to 24 months. The group said server logs contain information that can be linked to a particular person and that collecting such data must comply with the EU's data protection laws. The working group said keeping the information for 18 to 24 months does not meet those laws, and it asked Google to justify its reasons for keeping the information for that length of time. The group said it planned to discuss this issue at a meeting later this month. In a response, privacy counsel Peter Fleischer said: "The Internet is a global medium, and the principles at stake -- privacy, security, innovation, and legal obligations to retain data -- have an impact beyond Europe and outside of the realm of privacy." He added: "These principles sometimes conflict: While shorter retention periods are good for privacy, longer retention periods are needed for security, innovation, and compliance reasons." Fleischer said Google believed it had "struck a reasonable balance between these various factors" and that its policies were consistent with E.U. data protection laws. Fleischer said Google needed to retain server logs for a variety of reasons, including: to improve its search algorithms for the benefit of users; to defend its systems by fighting click fraud and spam; to comply with data retention legal obligations; and to "meet valid legal orders from law enforcement as they investigate and prosecute serious crimes like child exploitation." "After considering the Working Party's concerns, we are announcing a new policy: to anonymize our search server logs after 18 months, rather than the previously established period of 18 to 24 months," Fleischer said. "We believe that we can still address our legitimate interests in security, innovation, and anti-fraud efforts with this shorter period. However, we must point out that future data retention laws may obligate us to raise the retention period to 24 months." Fleisher said Google disagrees that it could meet "legitimate interests in security, innovation, and anti-fraud efforts with any retention period shorter than 18 months." In addition, Fleischer said Google was considering the working party's concerns about cookie expiration periods and said it was looking into ways to redesign cookies to improve privacy and would make an announcement on the issue in the coming months. "As we build new products and services, we look forward to continuing our discussion with the Article 29 Working Party and with privacy stakeholders around the world. Our common goal is to improve privacy protections for our users," Fleischer said. In his blog, search engine analyst Danny Sullivan, editor-in-chief of SearchEngineLand.com said, "It's nice to see Google make such a fast, responsive move, though it is reacting to something that felt more like a political show rather than a real effort to improve privacy protection." Sullivan also criticized the working group for singling out Google. "I find the letter fairly amazing from a group that supposedly is concerned about privacy, in how it fails to ask any substantial questions and suggests, frankly, technical ignorance," he said in his blog. "It simply feels motivated out of political posturing. Where are the letters for Microsoft and Yahoo?"ADVERTISEMENTIBM Information On Demand 2006Industrial Industry Leaders, please join us at IBM's premier information management global event, IBM Information On Demand 2006, October 15-20, Anaheim, CA. More IBM business and technical solutions content in one place than ever before! Select from  over 800 sessions. Register today!
570280
InfoWorld - One week after&#160;hackers stole personal information from millions of people who had posted their resumes to the job-searching site Monster.com, the company has warned its users to be vigilant about online fraud because the breach was not an isolated incident.
258723
Work details used for targeted attacks Monster Worldwide, the owner of employment search site Monster.com, last week began notifying the estimated 1.3 million users affected by a breach that leaked rÃ©sumÃ© information and pledged to beef up network monitoring and defenses to prevent such a leak from happening again.â¦
522729
Dell announced early this morning it has received a notice from the NASDAQ stock exchange threatening the company with a possible de-listing if it continues to delay the filing of its quarterly 10-Q report.  Dell remains the target of an SEC probe, and may have to restate its earnings back several years.
315842
Company has defended its practice of sometimes slowing P-to-P networks such as BitTorrent.
12412
By Kevin J. O'Brien and Thomas Crampton  In the latest example of a U.S. technology giant potentially being called on the carpet in Europe, Google has been warned that it may be violating European Union privacy laws by storing data on its users for up to two years.
212858
Company denies the chip has been delayed, but many had expected it sooner.
712980
(InfoWorld) - The U.S. Congress can help protect residents against identity theft by passing a data breach notification bill that would also require companies to use reasonable security practices, officials from cybersecurity vendor Symantec said Tuesday. Robert Clyde, Symantec's vice president of technology, called on Congress to pass a data breach notification bill that would require organizations to report data breaches when there's a reasonable risk of identity theft. U.S. lawmakers introduced about a dozen bills requiring data breach notification after a series of breaches in early 2005, but legislation stalled largely over committee jurisdictional squabbles. About 30 states have passed breach notification laws, most of them since 2005. U.S. lawmakers have introduced four data breach notification bills since January. Private companies want one standard they can follow instead of dozens, Clyde said. "Having every state do their own data breach law ... starts to get out of control real quick," he said. "You put a huge burden on companies." In the last couple of years, Symantec has seen a change in cyber attacks, prompting the need for legislation. Gone are the days when attackers created viruses or worms simply for bragging rights; now, the majority of cyberattacks are targeted at stealing money, Clyde said. In many cases, the attacks are done with stealth in mind, with the criminals hoping to milk credit card accounts for months, he said. Often, ID thieves will take $5 or $10 from a credit card account every month, and most people won't notice the small charges, Clyde added. "The motive [of hackers] has changed from show-off to taking money," Clyde said during a briefing in Washington, D.C. Symantec called on Congress to pass a data breach bill that would include language requiring organizations to deploy standard security protections. "We'd like to see legislation be more proactive," said Tiffany Olson Jones, senior regional manager for North and Latin American government relations at Symantec. Part of the problem with passing a bill last year is that some of the legislation became too expansive and included several privacy measures, Clyde said. A simple data breach bill that focuses only on security breaches should have the best chance of passage, he said. Symantec endorsed the Data Accountability and Trust Act, introduced earlier this month by Representatives Bobby Rush, an Illinois Democrat, and Cliff Stearns, a Florida Republican. The bill, in addition to requiring breach notifications to affected customers, would authorize the U.S. Federal Trade Commission (FTC) to draw up data privacy requirements for businesses, including requirements that they have vulnerability assessments and policies for disposing of obsolete data. After a company reports a data breach, the FTC would conduct an audit of its security practices, and the bill would require data brokers to disclose the information they hold on individuals and allow individuals to correct wrong information. Symantec also called on Congress to pass an antispyware bill. Several ways that spyware steals information, such as keystroke logging, isn't expressly prohibited in other cybersecurity laws, Clyde said.
30507
Users of a Web site operated by the U.S. government were among job seekers whose contact data was stolen by hackers who broke into computers at Monster Worldwide Inc, a U.S. government spokesman said on Thursday.
106857
By now, the perils of securing online data with little more than user names and passwords should be well known. Monster.com learned that lesson late and the hard way, prompting this week's announcement that the Web jobs board will spend millions of dollars to improve its security.
679376
A spouse and a peer-to-peer file-sharing program appear to be at the center of a data breach that exposed information on 17,000 Pfizer employees -- and maybe other individuals as well. Investigators would like to know why it took the company six weeks to reveal the problem.
142016
Officials from cybersecurity company tells the U.S. Congress that a data breach notification bill with reasonable security practice requirements would protect Americans.
324484
(InfoWorld) - Google Inc. will make the data it stores about end users anonymous in its server logs after 18 months, part of an effort to deflate concerns about privacy raised last month by a European Union working group. In a letter sent to the group on Monday, Google also said it is looking at ways to redesign its Web cookies and reduce the length of time they are stored on users' PCs. Cookies are small files that uniquely identify a Web browser and are widely used to track surfing behavior and store user preferences. The letter, from Google's global privacy counsel, Peter Fleischer, was in response to a letter sent last month by the E.U.'s Article 29 Data Protection Working Party, which outlined its concerns about Google's service. Among them, it questioned why the company needed to retain its server logs for 18 to 24 months, saying the practice does not appear to meet Europe's data protection rules. The server logs, which include search histories, can be linked to individual users and therefore constitute personal data, the group said. Fleischer responded by saying that Google would make data anonymous in its server logs after 18 months, the low end of its previous commitment. "We ... firmly reject any suggestions that we could meet our legitimate interests in security, innovation and anti-fraud efforts with any retention periods shorter than 18 months," Fleischer wrote. The company said it needs the log data to improve its search algorithms, fight click fraud and spam, comply with data retention laws, and meet "valid legal orders from law enforcement as they investigate and prosecute serious crimes like child exploitation." It noted that the E.U.'s own Data Retention Directive will require companies to retain such data for 6 to 18 months when new laws go into effect by 2009. Since few countries have passed their retention laws yet, "we have no choice but to be prepared to retain log data for up to 24 months," Fleischer wrote. The working group had also complained about the length of time Google stores cookies on users' PCs. Google said that it is exploring ways to redesign its cookies to improve privacy and that it would make an announcement "in the coming months." One observer, while acknowledging privacy concerns about Google, was critical of the working group for singling out one company. "These concerns would have been equally applicable to Yahoo or Microsoft or many other companies on the Internet," said Danny Sullivan, editor-in-chief of the Web site Search Engine Land, who wrote a detailed analysis of Google's response. Microsoft and Yahoo have not specified how long they store their log files, he said, and they may retain them for longer than Google. He also said the group showed "technical ignorance" by focussing on server logs. Like other search engines, Google collects information about users each time they register for a service such as Gmail or Adwords. These "user databases" contain more personal information than server logs can gather, and they are often retained until a user closes the account or actively deletes the information, he said. The working group in its letter last month cited Google's "market position and ever-growing dominance." It also thanked the company for its "ongoing engagement with the data protection community," especially in contrast with "a lack of engagement by some of the other leading players" in the search industry. The group is expected to discuss Google's response at a meeting later this month. Â