Slashdot Mirror
Is Your Banking Information Accidentally On Ebay?
GraWil writes "The Toronto Star is reporting how two Bank of Montreal computers containing thousands, of sensitive customer files were sold to a student who fixes up machines and then resells them on eBay. It seems that the company responsible for scrubbing the disks (Rider Computer Services Ltd.) misfiled the machines in their warehouse and it was assumed they had been erased." It's not the first time this sort of thing has happened.
My take on the whole issue is that somebody caught it and went public with the information soon enough to prevent damage.
Lets hear it for the unsung heroes in life.
They should just get rid of it and save us all alot of headaches while recouping some money from the second hand machine.
Personally, i think that any hard-drive that has been used for that purpose should be securely destroyed instead of being sold. Simon.
Don't you just love it? If protection of customer information indeed is your number one priority then why the fsck don't you have procedures is place, which make such a blunder outright impossible? And if you do have such procedures in place why don't you enforce them?
Are those PR liars (and what else could such a "chief privacy officer" making such an outragous statement actually be?) all cranked out by the Forked Tongue Institute for Marketing & PR, or what?
ich bin der musikant
mit taschenrechner in der hand
kraftwerk
First off unless the entire IT department of the bank are complete morons, most financial data is NOT kept on loacl machines but the file server and the main database machines.
I know that the caches and things MAY hold some sensitive data but it's highly unlikely.
Unless the person that used that PC in the bank was also a incompetent boob and say saved a spreadsheet of 200 credit card numbers and information in the local drive (why the hell are you making an insecure document like that?) it's only a mild security breach.
It shakes the confidence of the customers more than anything else.
Do not look at laser with remaining good eye.
There are valid reasons for checking out the contents of the HD -- if you think a machine might have been stolen, then finding the prior owner is the right course of action. I know of one dumspter diver who tried to reunite an old PC and its data with its former owner. The former owner was pleased by the honesty of the finder and upset that the HDs had not been wiped as promised by a PC recycling company.
The hardest case that I heard was a used computer buyer that ran across some very disturbed writings on a old machine. Violent written fantasies could have been just someone letting off steam, writing fiction, or a prelude to going postal. Finding potential evidence of a forthcoming crime places a severe ethical burden on the finder of the computer files.
Personally, I don't make a point of snooping and tend to just reformat the HDs of old computers that I buy. This also forestalls the licensing issues with old software on old computers -- that old copy of M$ Office may (or may not) be legal.
Two wrongs don't make a right, but three lefts do.
As appealing as physical destruction of an HD is, it is not a wise course of action. As with most electonics, HDs contain lead, glass fibers in the circuitboard, and caustic chemicals in the electrolytic capacitors. And I have no idea of the potential toxicity of the materials coating the platters or used in the rare earth magnets in the actuators and motor.
Turning data into dust creates an environmental hazard. Therefore, it's better to send old electronics to an institution that has the tools and procedures for safely recycling/recovering/reprocessing the materials in the HD. Yet we obviously cannot and should not enrtust these companes with our sensitive data. That is why some form of encryption (either in hardware or software) is the solution to making the data unrecoverable.
Two wrongs don't make a right, but three lefts do.
Shouldn't customers' private information have at least as much rights as some stupid Brittany Spears song?
Bravo to them! A refreshing change from all the stories of corporations responding to security issues by shooting the messenger.
"How to Do Nothing," kids activities, back in print!
Gov't employees, military personnel and law enforcement in sensitive areas have to go through a background check.
This begs the question, what sort of background checks are performed on the technicians fixing the computers? And what sort of computer security experience do they have?
I would at least expect a "student" not be employed in this type of position. Give it only to a qualified full-time employee w/ good compensation and benefits - that in itself should be a deterrent.
Since the Bank is responsible to Canadians for how it uses our information, why didn't it just scrub the disks in house, even something like format c:
then send the box to the outsourcers?
If this keeps happening, you bet Canadian Bank Law will mandate they do their own scrubbing...
The banks should have 0'd or trashed these drives before selling them. I see this type of neglect as soley the responsibility of the bank.
Why? Well, if you hire an accountant and don't double check his work, it's your arse. Why should it be any different with a corporation's responsibility when it comes to guarding customer data?
Personally, I would like to see more laws guarding US. Not slapstick anti-terrorism laws directed at destroying personal privacy, but real laws that protect real people. As we are the source of America's economic might. At the point where citizens don't have money to throw at giants, then the giants won't exist anymore. At least, not inside our borders.