Credit issuer says data lost for 650,000 customers
614212
A computer tape containing personal data of 650,000 customers of about 230 retailers including J.C. Penney Co is missing, credit card issuer GE Money said on Friday.
469067
The records of nearly 2.3 million consumers have been exposed after an employee of a Fidelity National Information Services subsidiary stole the information and then proceeded to sell it to a data broker.
183524
About 70,000 BT business broadband customers have had trouble logging onto the internet on Friday due to a technical fault.
172460
TJX has revealed that a breach of its credit card transaction systems occurred a year earlier than previously disclosed and that many more customers may have been affected.
353805
The personal details of up to 600,000  people were lost when a Royal Navy officer's laptop was stolen  in the latest embarrassment to hit British Prime Minister  Gordon Brown.
133852
Northern Rock customers have complained of problems accessing their online accounts.
389596
Business & money: Ill-judged comments saw deluge of customers reclaiming bank charges, says lawyer
151943
A missing unencrypted tape containing 650,000 retail credit-card accounts has gone missing, affecting 230 US retailers.
389598
Massachusetts' new top business regulator yesterday called on retailers to start disclosing how well they protect customer credit-card and debit-card data, an idea gaining traction after a data breach at retailer TJX Cos. last month.
7000
(InfoWorld) - A stolen laptop at The Boeing Co. has pushed a widely watched tally of U.S. data breach victims past the 100 million mark. On Tuesday, Boeing disclosed that files containing Social Security numbers, names and home addresses of 382,000 current and former employees were compromised in early December when an unencrypted laptop was stolen from an employee's car. That disclosure pushed the total number of data breach victims on the Privacy Rights Clearinghouse Web site to 100,152,801, said Beth Givens, director of the consumer advocacy group. Privacy Rights Clearinghouse has been tracking data breaches since February 2005, whenÂ ChoicePoint disclosedÂ that thieves had stolen information on 163,000 victims from the company's database. The ChoicePoint incident was remarkable because although the data broker was obligated to disclose the theft to victims living in California -- the only state with a beach notification law on the books -- it decided to notify everyone, Givens said. "That was the first time, to the best of our knowledge, that a breached entity decided to disclose the event to individuals nationwide," she said. "That was a watershed event," she added, "because other entities that had experienced breaches started disclosing the situation to individuals nationwide" Since the ChoicePoint incident, data security has been in the spotlight, andÂ breaches at the U.S. Department of Veteran's AffairsÂ and, most recently, Boeing and theÂ University of California-Los Angeles, have received national attention. Givens believes that the actual number of names that have been compromised since ChoicePoint is probably much higher than her tally. "I think the number 100 million is largely a fictional number, but what it really indicates is that this is a very significant problem," she said. She couldn't say whether all the publicity has made consumers any more secure. "It's quite obvious from the listing that we've compiled that we're in a very leaky boat when it comes to data security," she said. "I don't think that consumers can feel confident about the protection that their personal information receives."
348960
The huge losses reported by French bank Soci?t? G?n?rale, apparently caused by a rogue trader with inside knowledge of the bank's procedures, don't necessarily point to an IT systems failure but rather to poor management of those systems, analysts say.The bank has accused 31-year-old employee Jerome Kerviel of creating a fraudulent trading position in the bank's computers that ultimately caused it to lose around ?4.9 billion ($7.3 billion).Kerviel achieved this by, among other things, misappropriating computer passwords, the bank said. It has revealed few other technical details of what caused the losses.Management of passwords, including rescinding the old passwords of employees who move to different positions within the bank, or modifying the level of access those passwords allow, is often a task given to the lowest-level IT worker."It's dull and routine 99 percent of the time, but a vital backstop," said Bob McDowall, senior analyst at the TowerGroup. Senior IT managers should conduct more frequent reviews of password policies, he said.In some cases, it may not have been the security of the passwords themselves that posed a problem, but rather the access those passwords allowed, said Ian Walden, professor of information and communications law at Queen Mary, University of London.Organizations tend to think of access as being binary in nature: you get access to it all, or you don't, Walden said. In reality, there are many more levels of access. "In modern, complicated systems, the granularity has to be much more sophisticated."To make the best use of systems with advanced access controls, the IT department must have a thorough understanding of how the business works and where there is risk.IT departments and business managers have yet to find a way to wrap security into business processes so it is not an impediment, Walden said."IT in a company is not given a sufficient status," Walden said. "What's shocking is you would have thought that the financial sector was more sophisticated than this, but it still tends to be the case that security is an add-on and a block, something you've got to live with but you don't have to like, rather than being viewed as an integral part of the business structure."Workers should be able to do their job without having to share passwords when someone goes on holiday, and the IT department should not make it harder for people to perform their duties, Walden said.In one extreme example at telecommunications company BT, one employee didn't have the right to use a computer at all, but he found it helped him do his job, Walden said."By the time he was found, he had 90 passwords of different employees," Walden said.It's possible that financial institutions could use biometric systems, such as fingerprint scanners, to provider an added layer of security, McDowall said. Those systems, however, are expensive. Also, the sometimes-finicky fingerprint scanners may not be appropriate in a frantic trading environment, McDowall said.Questions remain about how Kerviel's losses could be so high given his job as relatively low-level trader. But Kerviel's career progression in 2005 from the bank's back office to the front office -- where he would have had access to client accounts -- is also troubling since he would have gained greater knowledge on the bank's inner controls, McDowall said.As an arbitrage trader, Kerviel made money off price differences between different financial products. Soci?t? G?n?rale said Kerviel balanced real and fake trades in order to avoid setting off internal alarms.Kerviel has been described in some press reports as a computer genius. However, most attackers used unsophisticated methods for exploiting systemic vulnerabilities in applications, processes and procedures, according to the 2005 "Insider Threat Study" by Carnegie Mellon Software Engineering Institute.That report notes that sophisticated tools are also used in some attacks, which would demand that internal financial systems need to be designed on a more defensive footing.Programmers should code under the assumption that a hacker or employee will use every means in order to break in, said Ben Rothke, senior security consultant at BT's International Network Services."The underlying issue is that many systems are designed to stop honest people from making mistakes, but do not take into account those with malicious intent," Rothke said.It makes insider jobs one of the toughest to defend against. The psychological profile of an insider tends to be a disgruntled employee who feels wronged by the company, according to the Insider Threat Report.That in turn can lead to a suspicious behavior such as staying late at work, which paradoxically might only signal a committed employee."It's always the insider," Rothke said. "It's often harder to steal $10,000 from a bank than $10 million."
9338
At least 94 million Visa and MasterCard accounts may have been exposed to potential fraud in a data breach at TJX, more than double the previous estimate by the discount retailer.
336942
Thousands of Wells Fargo mortgage and student-loan customers may be at risk for identity theft after four computers were stolen last month from a vendor that prints loan statements.
405024
Credit card issuer warns of weak spending and increasing delinquencies.
532618
ChoicePoint has settled with 44 states over its loss of data on 145,000 consumers. The company is also to pay about $500,000 in fines. As part of the agreement, ChoicePoint will put in place better security to protect consumer data.
586599
Electronic Data Systems has admitted that an error by one of its computer operators during a Microsoft Windows upgrade caused 40,000 PCs at the United Kingdom&#39;s Department of Work and Pensions to crash last month.
298489
The personal details of 600,000 people have been lost after a laptop was stolen from Royal Navy officer