Over Half a Million Bank Accounts Breached

Gone Phishing writes "CNN is reporting that about 676,000 bank accounts in at least four banks (Bank of America, Wachovia, Commerce Bancorp, and PNC Financial Services) have had personal information "illegally sold". Over 60,000 customers have been notified so far."

Comments

Stolen Account Information and Dupes

[ari_j]

Oftentimes, I'll complain about Slashdot dupes. Why can't this be one of those times?

Re:Stolen Account Information and Dupes

[NoTalentAssClown]

Great. So far this year I've received a letter from from LexisNexis and Choice Point. When my identity was stolen at the beginning of the year I thought "How could this happen? I have been so careful with my information." Apparently is doesn't matter how careful *I* am when everyone else just seems to be giving it away. Something has to be done to punish these people other than sending me a letter with how to PAY someone to watch my credit and alert me to "changes".

Re:Stolen Account Information and Dupes

[to_kallon]

Apparently is doesn't matter how careful *I* am when everyone else just seems to be giving it away. Something has to be done to punish these people other than sending me a letter with how to PAY someone to watch my credit and alert me to "changes".

i don't know what will happen in this case, but i know when lexisnexis was breached (in point of fact it was actually a smaller company purchased by lexisnexis and the breach happened before the purchase) the company offered, and hired quite a bit of staff to support, credit checking and reporting for affected customers for free. as for punishment, sure, that sounds good, but would be nearly impossible to implement in a fair manner as, in this case, lexisnexis was not responsible for the breach in any way, shape, or form. therefore to punish them for a breach not resulting from their actions would be unjust.
i agree, these things shouldn't happen so often, but slapping "punishments" around doesn't help solve the actual problem.

Re:Stolen Account Information and Dupes

[Anonymous Coward]

Since both a former employer of mine (SAIC), and a store that I made purchases at (DSW) have had recent losses of data, I am maintaining a fraud alert on my records at the credit bureaus. You can do this for free simply by calling any of the "big three" (Equifax, Experian or Trans Union) and requesting it. You only need to contact one of them, as the alert information will be forwarded to the other two. (It only lasts for 90 days, so you'll have to renew if you want it to continue.)

Re:Stolen Account Information and Dupes

[badasscat]

as for punishment, sure, that sounds good, but would be nearly impossible to implement in a fair manner as, in this case, lexisnexis was not responsible for the breach in any way, shape, or form. therefore to punish them for a breach not resulting from their actions would be unjust.

How about punishing them for their inactions? If somebody walked in to a military base and stole a nuclear warhead, would you throw up your hands and say "well, it wasn't the military's fault; they're not the ones who stole it"? Of course it's their freakin' fault! Who's supposed to be guarding this stuff??

Then of course, there's the issue of why they need to have this info in the first place. Just as you could argue if we didn't have nuclear weapons in the first place then there'd be no reason to worry about them being stolen, so you could argue that Lexis-Nexis - a company most of us have absolutely no contact with - should not have things like our social security numbers (which are for, you know, our individual social security payments, not anything else) to begin with.

If you are going to take it upon yourself to store my information, then you had damn well better safeguard it. And if you don't, then you should be held liable, and you should be punished severely when data is stolen through your negligence. (And in this case, I define negligence as "any case where your security was lax enough to allow data to be stolen" - or in other words, every single case of a security breach.)

If a company cannot secure this data to the point where it cannot be stolen, then they have no business holding this data to begin with.

Re:Stolen Account Information and Dupes

[PacketScan]

These companies will never learn.. Because there is nothing in place to bring them to their knees. Oh wait that's right. We have a say in our government. But only if you have $$$ so let get some money to gether and buy a congress person or two.

Re:Stolen Account Information and Dupes

[TheGavster]

As fast as you build walls, people will find some way to breach them. It is outlandish to expect a company to do any more for you than you have contracted with them. When you signed up with your bank, did they promise unbreachable security? I presume that a person so conscious of identity theft would have inquired with their financial institution as to security measures prior to giving them anything, and failing sufficient security, not done business there? In the end, you entrusted your information to some one. Unless you have some agreement about what happens if that data should be compromised, anything they do for you is out of the goodness of their hearts.

Re:Stolen Account Information and Dupes

[Afrosheen]

So, you're saying it's unreasonable to trust the bank with your information and your money? Well, what's the point of having a bank account then? I know a guy named Vinnie down the street that'll loan me money and hold my money for me. The only difference here is that Vinnie won't leak information and won't lose my money.

Bank of Vinnie: Now 99% more secure than Bank of America.

Re:Stolen Account Information and Dupes

[Afrosheen]

"...so let get some money to gether and buy a congress person or two"

We'll let you be the spokesperson, you seem to have a strong grasp of the language.

Re:Stolen Account Information and Dupes

[TheGavster]

I think that it is reasonable to trust a bank more than an alley bank shark. I do not, however, think that it is reasonable to expect 100% security. Banks get robbed. These things happen, they do their best to prevent it, and there is no need for them to be 'severely punished'. If you need to punish anyone, start with the theives, and end with the sensationalists who make it seem like banks just give this stuff away.

Re:Stolen Account Information and Dupes

[Vitriol Angst]

I can't understand the "Group Think" that is going on. The same people who want to unleash the FBI on kiddies who download mp3's seem to never hold businesses accountable for anything.

We are so ripe for authoritarian rule. We want to leave control of our lives to others, and all we expect of security is to punish someone who doesn't cross every t and dot every i when they report on the failures.

The fact that Wachovia has my money and social security number and can demand many things of me without proof (such as fees and late charges), means that conversely, they should be responsible and compensate me for any damages resulting from their failure to live up to this trust. I think I need to pull my money out this week.

I thoroughly expect the news service to retract and fire anyone who reported this, but might have gotten the date wrong.

Re:Stolen Account Information and Dupes

[Ty]

Yeah that's all fine and good but you should know that Vinnie takes your dough and deposits in the bank down the street.

Re:Stolen Account Information and Dupes

[Zork the Almighty]

When banks get robbed, do they take a percentage out of my account ?

Re:Stolen Account Information and Dupes

[Karl Cocknozzle]

sensationalists who make it seem like banks just give this stuff away.

My beef is not with banks... They are generally pretty dilligent about customer data--they've been doing this stuff for a while now. MY beef (and I believe the parent poster's beef) is a company he has never done business with acquiring, storing, and failing to secure his personal information. Certainly, we should punish the identity thieves--and severely. But the reality is that, in the case of ChoicePoint, (whom the parent poster cited as contacting him,) they simply didn't have adequate protections in place to keep somebody from pretending to be a "legitimate" buyer of personal information. (We'll leave for another day the argument that there should be no such thing as a "legitimate" sale of my personal information by anyone but me. If Choicepoint wants to PAY ME to list my personal information for their own potential profit, that is another story, of course.)

Bottom line? If ChoicePoint wasn't in the super-sleazy, ethically dubious game of gathering and selling personal information, the data that was "accidentally sold" to these inappropriate persons would never have been divulged--because they never would have had it in the first place to be ABLE To divulge it.

Re:Stolen Account Information and Dupes

[Croaker]

that sounds good, but would be nearly impossible to implement in a fair manner as, in this case, lexisnexis was not responsible for the breach in any way, shape, or form. therefore to punish them for a breach not resulting from their actions would be unjust.

Um... have you thought this through? If what you believe were the law, then any company that has a legal issue, such as liability for security breach, illegal dumping of toxic waste, products that become sentient and wipe out humanity, etc. could get complete absolution if it got bought out by another company. "Oops! Sorry! You can't punish us! We got bought out be Totally Innocent Corp." And you can bet, a buyer can be made to appear at an opportune time, whether it be a real buyer or a shell company set up for the express purpose of ducking liability.

When Company A buys Company B, Company A should not only get the assets of that company, but it also take on the debts of that company and the responsibility under the law for any past actiona of that company. And I believe that's how it works under the law.

Re:Stolen Account Information and Dupes

[denissmith]

A couple of years ago one of my credit card companies sent a mailing with a blank check, good for up to $ 26,000, for any reason - 0% interest for the first 3 months! Take that Dream Vacation!! Deposit it into your account !!! Which the person who actually received the letter did. Trouble was, it wasn't me. I've received other stupid, insecure mailings from other stupid, insecure companies. Half the people I know have had their identity stolen ( this is New York) at least once. None of them were at fault for the disclosure. It was always the merchant or the credit issuer with the problem. Wow. You are right, somehow these companies need real sanctions.

Re:Stolen Account Information and Dupes

[twstdroot]

Did you even read the article? Someone from inside, at least at one of the banks, sold the information to the guy. Are you suggesting that banks keep your information secure from all of it's own employees?

Re:Stolen Account Information and Dupes

[dingfelder]

Yes, Exactly.

That would be a good idea.

No Wachovia bank employee (except maybe the security team or tax man) should ever be able to see my SSN for example.

Re:Stolen Account Information and Dupes

[Anonymous Coward]

When banks get robbed, do they take a percentage out of my account ?

A bank takes a percentage of your money even when they aren't robbed.

Re:Stolen Account Information and Dupes

[Anonymous Coward]

I can't understand the "Group Think" that is going on. The same people who want to unleash the FBI on kiddies who download mp3's

That's Slashdot group think for you. The FBI has never charged anyone with downloading an mp3. I'm not sure anyone has been charge for uploading one either, but some have been sued by the RIAA for uploading.

Re:Stolen Account Information and Dupes

[twstdroot]

Sadly, someone from the IT group would always be abl e to see that info. And this information was leaked by high ranking executives! What's broken here is the people who were so easily convinced to give the data up... not the banks.

Re:Stolen Account Information and Dupes

[DavidTC]

No, not even then.

The tax man might show up with a supenae and themselves know your SS number, but there's no reason at all for the bank to know it, period.

Re:Stolen Account Information and Dupes

[boy_afraid]

Fageddaboutit! I takes it to the Ruskies and then put some of it on da ponnies. I'm a gonna make you some munny from the damn Ruskies with a higher rate of return than tha fedz. Badda-bing Badda-boom, you get one hella nestegg from me.

Re:Stolen Account Information and Dupes

[ioiosotwig]

Here is the credit card companies "BIBLE" in regards to security... Payment Card Industry Data Security Standard: http://usa.visa.com/download/business/accepting_vi sa/ops_risk_management/cisp_PCI_Data_Security_Stan dard.pdf

Re:Stolen Account Information and Dupes

[Damvan]

"It is outlandish to expect a company to do any more for you than you have contracted with them."

But that is the whole point, we haven't contracted with any of these companies to do anything with our data. I never signed a contract with ChoicePoint, never even heard of them until this fiasco, but they still lost MY data. So I guess since I had no contract with them, they are not responsible for keeping that data secure? Then I want the ability to take MY data away from them if they are not going to protect it.

Re:Stolen Account Information and Dupes

[gumbo]

You know, I was a victim of identity theft a year ago. Someone in another state ordered all his utility service using my name and SSN, and so I found out when I started getting letters from collection agencies. The thing is, I have no idea where he got that info from, so even if there was a way to punish people who let the info leak, it's not exactly easy to track it back (unless it's something as big and public as this case).

And to top it off, I use Wachovia, so this case might just be the start of some new identity-stealing adventures for me.

Re:Stolen Account Information and Dupes

[Anonymous Coward]

The best punishment? Sue LexisNexis and Choice Point for libel when they give you a bad credit report

Re:Stolen Account Information and Dupes

[Foobar of Borg]

Actually, reading the article, it looks as though it was a bit of an inside job with Orazio Lembo paying off upper level bank employees. I think if everyone who banks at a bank that does a poor job of security simply takes their money out and goes with a different bank, perhaps a small, local one which often has better interest rates anyway, they would quickly change their practices. Sure, you would be giving up the convenience of tons of ATM locations. But compared with the inconvenience of having your idenity and bank account owned, I think having only a few available and free ATM locations is minor.

Re:Stolen Account Information and Dupes

[Foobar of Borg]

Oh, this kind of thing pisses me off to no end. I used to get checks all the time from certain lending companies, and of course "convenience" checks from the credit card company. I called the lending companies up to bitch at them about something that is clearly unethical and all I got was the "we are breaking no laws" garbage. Since this sort of nonsense is obscenely insecure, it should be explicitly outlawed with severe penalties to any companies who break it.

But, I don't see our glorious leaders doing anything about that anytime soon, even though this would probably be a hot compaign topic. I would like to see the reaction of people thinking, "Wow! A [whatever position] candidate who actually cares about real people! Who would have thought it was possible?"

Re:Stolen Account Information and Dupes

[Anonymous Coward]

You and me both. Mine was LexisNexis and Westlaw who sent letter. I also had my credit card taken over and bought a car in Puerto Rico along with opening up several instant loans. I sure was a busy boy for a couple weeks .

Re:Stolen Account Information and Dupes

[superpulpsicle]

Actual Bank Transcript... no joke.

Operator: Hi, your account has been on the fraud list and one of the transaction is under investigation.

Customer: What do you mean?

Operator: There has been a debit of $15000 in a transaction last night.

Customer: Have I been robbed?

Operator: Sort of. Because you did not purchase our Anti-Fraud plan, we will be working in recovering the stolen amount. But you will see a permanent debit of $60.

Customer: So I gain $15000 back, but lose $60?

Operator: yes

Customer: Great!

Re:Stolen Account Information and Dupes

[Zakabog]

Then of course, there's the issue of why they need to have this info in the first place. Just as you could argue if we didn't have nuclear weapons in the first place then there'd be no reason to worry about them being stolen, so you could argue that Lexis-Nexis - a company most of us have absolutely no contact with - should not have things like our social security numbers (which are for, you know, our individual social security payments, not anything else) to begin with.

So when you call up the bank and ask for a new card cause your old one was stolen, how exactly are they supposed to know that you are who you say you are? A social security number helps because the only other things are your name, address, relatives names, whatever. Unless you suggest we all use passwords to verify ourselves with banks? But then what if I want to sign up for a new credit card. I use your name and address, and since you don't have a credit card with this company, there's no password (and there will be different passwords for each company since if they're all the same then that's just like a SS#.) What's keeping someone who knows you well from getting a credit card under your name?

Re:Stolen Account Information and Dupes

[Anonymous Coward]

Yeah, but is Vinnie FDIC insured?

Re:Stolen Account Information and Dupes

[ColaMan]

What's keeping someone who knows you well from getting a credit card under your name?

I don't know about you, but in australia, it's called "100 points of ID"

From some random .au website:

Please note that your current licence/registration issued by this Office is not sufficient as proof of your identity. You will still need to produce documents that add up to 100 points or more.

Group A Each document is worth 70 points

* A fully certified birth certificate (or copy certified by a Justice of the Peace)
* A current passport
* An Australian citizenship certificate.

Group B Each document is worth 40 points

(preferably containing a photograph of the applicant)

* A current licence or permit issued under Australian law, eg. Driver's licence
* Identification issued by Government authorities eg. one of the following:
* Public Service employee identification
* Evidence of your entitlement to financial benefits or other entitlements from the Commonwealth or a State or Territory Government
* A student identification card issued by an Australian educational institution
* A statement from your employer or an acceptable referee verifying your identity and certifying that they have known you by your name for at least twelve months. (Preferably with a photograph of you signed by the employer or referee).

Group C Each document is worth 25 points

* Official correspondence addressed to you such as a public utility account (eg. gas, water, electricity), council rates, bank statement or similar
* Bankcard, Visa or other credit card
* Any other document which in the opinion of the person to whom it is produced, provides similar verification of the applicant's identity.

Re:Stolen Account Information and Dupes

[kd5ujz]

Banks have FDIC to cover accounts incase of robbery($100,000/per account I belive). But if they steal your financial information ( credit loans, SSN, whatever) you are screwed.
To paraphrase Wanda Sykes Hall:

If a black dude mugs you, you lose what you have on you, if a white dude(she was speaking of Enron) robs you, you are screwed for the rest of your life.

Re:Stolen Account Information and Dupes

[smaug195]

There is actually a reason for the bank to know it, they are violating the PATRIOT act if they are not


The Rule requires banks to obtain an identification number from every customer opening an account. For U.S. persons, that identifying number must be a social security number or a taxpayer identification number (TIN). There are no exceptions.

Re:Stolen Account Information and Dupes

[wdmr]

This is pure garbage. We *have* contracted banks to safeguard our personal information. Banks have a host of legal obligations regarding the safeguarding of personal information. And even if they didn't, their websites and agreements are full of statements like:

"Keeping financial and personal information about you secure and confidential is one of our most important responsibilities. Our systems are protected, so information remains secure." (Bank of America, Online Privacy and Security Policy)

I'm sure there are similar statements in the microprint contracts we all threw away the day after opening our checking account.

Heads *will* roll over this.

Re:Stolen Account Information and Dupes

[taped2thedesk]

Couldn't company A just "spin off" most of their company into company B, then close company A to relieve themselves of any liability?

Re:Stolen Account Information and Dupes

[wdmr]

The theft was systemic over an extended period. Yes, I do expect that employees should not be able to perpetrate this sort of crime over an extended amount of time.

If they discover that the theft used formal egress channels (corporate email or personal webmail via proxy servers, for example) the banks are probably liable due to negligence in securing their environment.

Banks, hospitals, and other organizations of "high public trust" must be held accountable to a higher standard when it comes to which employees have broad access to personal data and what information they allow to leave their premises (phyiscally or electronically).

Re:Stolen Account Information and Dupes

[Anonymous Coward]

My beef is with the banks. What good is the stollen info if you can't take it to a bank, claim to be that individual and use their info to open a line of credit. Look at how many credit card applications you get every week. The banks could care less whos info you are giving them as long as it looks good. So yes when a bank allows a credit line to be opened and it turns out to be fraudulent that bank should be made to pay. And Pay and pay and pay!

Re:Stolen Account Information and Dupes

[drewzhrodague]

Who gives a shit if they're xyz insured. Does that mean anything? With my prior personal experience, I may have better luck either keeping cash in a sack under my mattress, or entrusting it to a nasty crack-ho than leaving it with whatever financial institution. Hay, Vinnie, c'mere a sec, I got some binness for ya.

Re:Stolen Account Information and Dupes

[twstdroot]

It's also pretty difficult to check your credit with out it. If you can find a bank that will give you a loan or checking account without your SSN.. let me know.

Re:Stolen Account Information and Dupes

[twstdroot]

It would be very easy for anyone higher then a bank teller to steal this information with a note pad. What's to keep me from folding up the paper and stuffing it in my shorts? Do you propose strip searches for all bank and hospital employees now? Welcome to the information age, your personal information is not safe and I think you'll be hard pressed to find any method for keeping it safe!

Re:Stolen Account Information and Dupes

[collinl]

Neither PCI, AIS or SDP would have prevented these incidents.

Simply these are people problems, not addressed by document reviews that these standards call for.

Re:Stolen Account Information and Dupes

[farley13]

From http://privacyfacts.lexisnexis.com/consumerswlette r/index.html : The letter includes instructions on how you can sign up for this help and a promotional code that eliminates the need to use a credit card to access the services, so you do not have to pay for the service. It sounds like you do not need to pay for the service. That said, it sounds like LexisNexis really needs to watch their collective asses.

Re:Stolen Account Information and Dupes

[Zakabog]

How do you apply for a credit card like that? You have to physically go somewhere and apply for one? And someone can't just steal some of your mail to pick up some statements? 4 bills and you've got 100 points.

Re:Stolen Account Information and Dupes

[Anonymous Coward]

Have you ever heard of a fucking SHIFT key?

Re:Stolen Account Information and Dupes

[Anonymous Coward]

No... Mine just sits here on the keyboard - doing it's shift thing when I need it. Pretty sure it isn't screwing around behind my back.

Re:Stolen Account Information and Dupes

[Anonymous Coward]

In the UK, we have a monitoring service provided by one of the biggest Credit Agencies, Experian: CreditExpert at http://www.creditexpert.co.uk/. It costs £50 a year, but as a subscriber, I think it is very good at what it does.

Re:Stolen Account Information and Dupes

[nanoakron]

Write to your politicians requesting something like the UK's Data Protection Act 1998.

http://www.opsi.gov.uk/acts/acts1998/19980029.htm

-Link to full text of bill.

-Nano.

Re:Stolen Account Information and Dupes

[Decker-Mage]

I'll admit that the people are broken. Social engineering or bribery is still the quickest/best way to break any security system. Still, having seen how many people have access to the entirety of the database information that banks, for instance, collect as a convienance, does not lend any assurance that this will not happen again in the future.

Secure systems are based upon the principle of least privilege and that especially includes your IT guys, not just your sales/account representitives. SA accounts should not be handed out like candy and you sure don't need it to backup or restore a database, yet I see time and time again every one and their sister, it seems, with an SA acount. Furthermore, fields should be default encrypted even to IT people unless they have a specific need, and that should be covered under a specific account. I could go on and on.

We'll see this happen again and again until everyone gets a clue what real security is about. That should happen about the time a certain place has a radical temperature drop.

Re:Stolen Account Information and Dupes

[blugeoned]

Yes, but Bank of America only charges $25 for bouncing a check. Vinnie takes out a knee cap!

Granted, Vinnies clients will tend to be more careful with their finances.

Re:Stolen Account Information and Dupes

[Vitriol Angst]

The RIAA can't arrest anyone. It could be police or FBI, depending on the charges. I don't think the particulars matter. They just have the power to throw people in jail for this nonsense--basically, criminal laws to protect profits that should be solved by technology or actually providing things that people will pay for.

The is no RIGHT to make a profit.

Whatever. The RIAA is pretty much the equivalent of forcing car owners to pay for buggy whips.

Re:Stolen Account Information and Dupes

[quarkscat]

Parent poster is right on target.

The laws in the USA (and other places, too, I suppose), place a great burdeon of responsibility on the individual. Every action an individual takes, as well as any inaction (like not clearing ice from a walkway) is subject to either criminal or civil punishment. Corporations (USA, again) seem to have all the rights of individuals, but without being held responsible at similar levels for their actions or negligent inactions.

In the USA, the burdeon on the individual has gone up appreciably via changes in bankruptcy law, while the burdeon for corporations has gone down via changes in venue for class action lawsuits.
Our neo-con political overlords don't want less judicial activism, they only want less judicial activism that favors the individual (or perceived populism). An ideal case in point is the uproar by the neo-cons over "conservative" judges who took the opposing view in regard to the Terri Shivow case. And the neo-con threat to overturn the US Constitution and 200 years of legislative tradition regarding filibusters in the Senate is yet another example. (The filibuster is one of the few mechanisms in the Senate that preserves minority party rights.)

And as far as Wachovia Bank is concerned, they have been busy gobbling up other regional banks using a slush fund of cash that they do not own. For at least 5 years, Wachovia Bank has been illegaly using a mechanism of offshore investment pyramid scheme to avoid paying any USA taxes on annual profits of $3 - $4 Billion USD. This is a tax avoidance scheme that the Dubya regime has not deemed fit to prosecute, apparently due to the large campaign contributions that Wachovia and the banking industry as a whole have been making.

When only one political party holds the balance of power in each of the three branches of government (Executive, Legislative, and Judicial), the entire system of government is ripe for a change hostile to the larger interests of the people. Absolute power (still) corrupts absolutely. Hearing a news report about Senator Frist calling his Senatorial political opposition "Nazis" was the icing on the cake -- "Todo, we aren't in Kansas anymore!" and this doesn't much look like a democracy anymore.

Re:Stolen Account Information and Dupes

[DavidTC]

In what universe does a bank need to check your credit before giving you a checking account?

Re:Stolen Account Information and Dupes

[twstdroot]

In this universe. Your credit is checked to make sure you weren't bouncing checks somewhere else. The bank also wants to make sure that you're not a large risk (i.e. going to overdraft your account to pay another bill and leave the bank holding the bag).

Re:Stolen Account Information and Dupes

[korekrash]

One more analogy.....what do you think a major corp would do if you were the holder of some very pertinent information that could destroy their company financially, then you lost it and it ended up in the hands of some frauds that milked the corp for millions.....I think LITIGATION is the word you would here a lot of then.......

Re:Stolen Account Information and Dupes

[jhylkema]

The best punishment? Sue LexisNexis and Choice Point for libel when they give you a bad credit report.

You can't. From the "Fair" Credit Reporting Act, 15 USC 1681h(e):

Except as provided in sections 1681n and 1681o of this title, no consumer may bring any action or proceeding in the nature of defamation, invasion of privacy, or negligence with respect to the reporting of information against any consumer reporting agency, any user of information, or any person who furnishes information to a consumer reporting agency . . . except as to false information furnished with malice or willful intent to injure such consumer.

You can sue them, say, for failing to reinvestigate a dispute (I have), but you can't sue them for reporting false information unless you can prove malice or willful intent.

Re:Stolen Account Information and Dupes

[Tassach]

If a company cannot secure this data to the point where it cannot be stolen

If it can be accessed legitimately, it can be stolen. The variables are how hard it is to steal, and how likely it is you'll get caught if you do.

US data protection act?

[Colin Smith]

Isn't there a US equivalent of the Data Protection Act?

http://www.opsi.gov.uk/acts/acts1998/19980029.htmh ttp://www.opsi.gov.uk/acts/acts1998/19980029.htm

A few holes, especially principle eight, but overall it does what it's supposed to.

Re:US data protection act?

[jd]

Not exactly. In fact, so not exactly that Europe has repeatedly warned the US that it is technically illegal for European companies to trade personal data with the US, due to a total lack of any privacy law.

The closest the US has is the DCMA, which prohibits the reverse-engineering of encrypted data for the purpose of copying it, which essentially makes it a crime to steal encrypted personal data, but I've yet to hear of anyone actually prosecuted this way and it is extremely unlikely to ever happen.

Largely because commercial companies often don't encrypt personal data for customers.

Re:US data protection act?

[joshdick]

No, but we sorely need one, obviously.

Congress recently began hearings to look into this matter but have yet to pass any legislation.

Re:US data protection act?

[Daedala]

In a word, no.

We have several laws that apply to personal data. There are gaps you can drive a truck through, and the industry has spent decades doing just that. (I particularly like the part about how the laws specify that they only apply to "authorized uses" of personal data--so if it's not an authorized use, you can do anything. No, I'm not kidding.)

Re:US data protection act?

[neverkevin]

I don't know if the US government has any specific policies reguarding PPI and financial data, but the HHS has HIPAA http://www.hhs.gov/ocr/hipaa/ for personal medical data. The state of California has SB1386 to protect Californians personal financial data. However, neither go far enough and I am supprised more incidents are not made public. I suspect there are many more security breaches that companies are quiet.

Re:US data protection act?

[Pakaran2]

Including transfer zillions of dollars overseas? As long as it's unauthorized? It's a wonder that anyone here in the US still has any money in the bank if that's the case.

Re:US data protection act?

[Anonymous Coward]

Short answer: NO.

Long Answer: Government serves the corporations. An equivalent act would serve the people. Once it was decided that corporations had rights in the good Ole USofA they could start to vote with their money.

Re:US data protection act?

[reallocate]

I don't know, but this could just as easily happened in the UK. Bank employees knowingly sold the data. The staff at your local Barclays could do the same thing, too.

Two points to remember: 1. No law (and there are laws against this in the U.S.) will prevent crime if the criminal believes he can get away with it; 2. The only techbical aspect of this crime is the way the data were stored. The same crime could have occured in 1905, except the info would have been passed in ledger books.

Re:US data protection act?

[caluml]

the DCMA, which prohibits the reverse-engineering of encrypted data

I thought it was encrypted copyrighted data. (IANAL)

Re:US data protection act?

[Anonymous Coward]

the material encrypted isn't relevant, only that it *was* encrypted.

Re:US data protection act?

[jd]

It is, but any authored organized data is automatically copyright, which means that by creating a database entry with your name, address, SSN, ccard info, etc, in a structured and organized manner, where that structure and organization is preserved by the system, you have created a copyrighted work. Unless, by entering the data, you sign an EULA with the company that the data belongs to them. At which point, you're screwed but the company may be able to claim they have obtained the copyright from you.

Re:US data protection act?

[fshalor]

It's called "TrustedComputing"...

Re:US data protection act?

[DogDude]

Exactly. It's in place. Everybody who has had data stolen should sue their banks. A bank that I just got a mortgage through sold my information, even though I explicity told them not to. Hence, I'm suing them. It's very simple, actually.

Re:US data protection act?

[arkanes]

This is not true. In fact, it is the opposite of true. Mere aggregation of data (like phone books, famously) are *not* copywritable. There is some wiggle room, especially if you have good lawyers - again famously, the annotations and numbers added by Lexis to court rulings are considered copyrightable, thus giving them a defacto control over large chunks of legal documents.

Because databases are not protected, many large personal-information companies have been pressuring Congress to pass special protection laws for them, but so far none have passed.

Re:US data protection act?

[Anonymous Coward]

It is not illegal to trade data but it is very restricted. European countries have extensive measures in contracts with American companies about how and where data is handled.

Re:US data protection act?

[Anonymous Coward]

Under such an act the *bank* could be held liable. That's a big difference.

Re:US data protection act?

[Anonymous Coward]

A law does nothing to stop outlaws.

Re:US data protection act?

[Anonymous Coward]

I hope that your lawyer is working on contingency because you're not going to win that one!

Re:US data protection act?

[YrWrstNtmr]

The employees that knowingly stole and sold the data already don't care about the bank where they (used to) work. A law can only serve to prosecute and convict the perps after the fact, not prevent it from happening.

Re:US data protection act?

[Anonymous Coward]

Sure, but such liabilities might form an incentive for banks to make it harder for employees to have accass to and steal over half a million bank account records.

Re:US data protection act?

[Anonymous Coward]

Holes, more like a gushing dyke.

Mandatory, legislated fines per instance is what is needed, starting with a fine of $1000 for each unauthorised sale, and serious jail time for negligent or greedy toadies out for a quick buck.

Despite Airline PAX data being 'given' away under a cloud of deciept, you can see why the big players want a free hand.

That attitude may change when 3rd world telemarketeers bombard, and resell such information. Begs the question why medical details are regulated, yet banks and other are not. Yep, with all those ID's out in the wild, that ID/Licence scheme is going to be as strong as the privacy laws are percieved. Leaks like these undermine and put things back years!

Re:US data protection act?

[Optic7]

How did you find out that they sold your information?

Re:US data protection act?

[Anonymous Coward]

Ya, it is simple ... until you get Republicans trying to pass "tort reform" to take the bite out of lawsuits. Their contributors are getting very irritated because lawsuits cost them too much money. They would like to be able to practice their crookery knowing that there is a cap on the damages they will have to pay. Enter the Republicans.

Re:US data protection act?

[YrWrstNtmr]

Someone has to have access. The only way is to have an extreme vetting process, to try (and I emphasize try) to weed out anyone prone to this. But even at the CEO level, you can't eliminate the asshats.

Re:US data protection act?

[san]

So, because you can't make it work perfectly you shouldn't try?

Anyway, I also happen to think that any company that holds data of such sensitivity should be morally and legally responsible for the confidentiality of that data.

Or is that too much to ask?

Re:US data protection act?

[YrWrstNtmr]

No, not at all! Just pointing out that the revered UK Data Protection law, just like every other law, doesn't actually prevent anything. Murder is illegal, with a far higher penalty, yet it still happens.

Re:US data protection act?

[reallocate]

Forget about the morality part of it. If everyone agreed on what is moral and everyone always lived up to that standard, we'd have no need for laws.

ANd, the law would require you to specify what "confidentiality" means.

Re:US data protection act?

[Anonymous Coward]

the site got 404'd!

Re:US data protection act?

[shitdrummer]

Actually, according to the link below, the Telephone book is copyrightable in Australia and the UK. In Australia the White Pages is for alphabetical residential and business listings, the Yellow Pages lists businesses by type e.g. mechanic, plumber.

http://www.wptn.com/crt_001_sep01.htm

Shitdrummer :)

Re:US data protection act?

[badmammajamma]

Yes, they want to get special protection laws passed. Unfortunately, it's not to protect the people who's information they warehouse. It's to protect themselves. The corporation who has your data couldn't give a flying fuck if your identity is stolen by every scammer on the planet. They care about keeping the information for themselves so that they alone have it, and so that they can sue people who take it and thus, make more money.

Re:US data protection act?

[arkanes]

As per the subject line, I was referring specifically to the US.

Re:US data protection act?

[Anonymous Coward]

"This is not true. In fact, it is the opposite of true."

Not X. In fact, Not X.

Interesting... I may be missing the connotation, but that seems redundant.

Hmmmm

[Anonymous Coward]

Checks bank account...

shit!

Re:Hmmmm

[Dareth]

Checks bank account... I check mine too!

shit! ...shit! too...

And I don't even use Wachovia!

Re:Hmmmm

[Anonymous Coward]

Isn't the proper format:

1. Check bank account
2. shit!
3. (someone else) profit$$

This could get ugly

[kcornia]

I'm sure the answer will be higher fees though, so in the long run the banks will be fine.

Re:This could get ugly

[ultimabaka]

Higher than zero would be something I would notice. At least for myself (as a Commerce account holder with a sizable amount of money in my account), this (a) scares the bejesus outta me, and (b) could not justifiably allow for an increase in fees beyond the zero I'm currently paying for them. And if there's any more left in my account after this (:\) I'll happily switch banks if they try to use this as an excuse to boost fees.

Re:This could get ugly

[refactored]

So far I haven't seen any signs of anyone actually reading the F'ing A.

The really interesting bit is who has been buying the information. This ball has in no way stopped rolling.

Re:This could get ugly

[ignorant_coward]

A while back banks like Wachovia tried to tighten down on their customers charging fees for seeing tellers, fees for ATM transactions, fees for deposits, fees for various forms, fees for breathing, etc. That didn't last long, so customers must have voted with their wallets. I know I rejoiced at being able to join credit unions at the time, because at least they don't treat their customers like an illness.

(off topic: what do blind slashdotters think of these new "confirm you're not a script" thingies?)

Oh...

[Anonymous Coward]

Oh.... I'm screwed.

My account is safe.

[mrcrowbar]

Fortunately, my account should be safe. I got a email from Bank of America telling me about their problem, and I filled out their form to resecure my account. Such at great company to take care of their customers like that!

Re:My account is safe.

[shawn(at)fsu]

lol

The sad thing is this weekend I got two of those emails from differnt 'banks'. I wonder how many people fall for them. I actually tried to contact the real bank of the first email but their contact us page was impossible so there wasn't anything I could do.

Re:My account is safe.

[WickedClean]

Were you sure to give them your ATM Pin number, because that is always an important part of account verification, you know? Especially for AOL and PayPal users.

Re:My account is safe.

[bahwi]

I wonder if people ever get those phising notices for banks that are actually fake and involved in escrow scams.

Re:My account is safe.

[Naikrovek]

I get about two dozen of these a week from places purporting to be eBay and PayPal, as well as several banks.

I can't even begin to wonder how many have fallen for these scams. its a damn shame.

Re:My account is safe.

[rpozz]

The problem with these scams is that the companies hosting them don't give a flying fuck. I've alerted the companies hosting very obvious phishing scams, and it takes longer than 24 hours before they take any action. If one of their clients is hosting a site designed to look like PayPal or whatever, they should shut it off that second. There's no two ways about it.

Re:My account is safe.

[Anonymous Coward]

They should shut it down because the account owner is doing something illegal not because you do not like what is on the website.

Re:My account is safe.

[rpozz]

It's nothing to do with what I think of it. If someone sets up a website that looks exactly like PayPal, then they are certainly doing something illegal. The website should be shut down as soon as the hosting company is notified and it's contents have been verified by the tech support staff.

Re:My account is safe.

[Spectre]

Um, are you sure it was the bank that contacted you? Sounds like a SPAM scam to me. . .

Are you by any chance damaged in the pre-frontal lobe?

Re:My account is safe.

[Anonymous Coward]

Somebody, anybody, please mod the parent and the great-grandparent up.

Re:My account is safe.

[bairy]

I always found that funny

If people got a letter in the post "from the bank" asking their personal details, bank details, pin number, and all the rest of it, most would ring the number to confirm it's real, or would contact the bank.

If it comes via email then yeah sure I'll fill this in, this is the Internet, what could possibly be dangerous about it.

Re:My account is safe.

[Cro Magnon]

Of course I gave them my PIN number. I even included my mother maiden name. Do I look stupid enough to forget such important things?

Re:My account is safe.

[WickedClean]

Okay, just making sure. They may email you again asking for the same information just in case. Be sure to respond every time. It gets the info updated much more quickly that way.

Old Story.....

[Anonymous Coward]

I read about this a month ago, in a letter from Bank of America.

No, realy...

Re:Old Story.....

[Anonymous Coward]

No, see this is a seperate incident. It happened AGAIN.

Opting Out of 3rd Party Information Sharing

[Anonymous Coward]

Good thing i've opted out of having my bank share information with other parties. Opting out of information sharing is a wise thing for everyone to do.

Re:Opting Out of 3rd Party Information Sharing

[flynns]

I'm not quite sure you understand. It was ILLEGALLY sold. Without the permission of the account holder. Meaning that whatever you SAID you didn't sold...doesn't matter.

Re:Opting Out of 3rd Party Information Sharing

[Anonymous Coward]

I think he does understand, but was being a smartass, leaving you looking quite the dumbass!

Re:Opting Out of 3rd Party Information Sharing

[flynns]

Aw, shit; I forgot to bring my Sarcasm Hat to work. Sorry, guys.

The bigger they are...

[__aaclcg7560]

This is why I switched to a local credit union a few years ago. Seems like the bigger the bank, the bigger the security breach. Worse... they nickel-and-dime you on everything else.

Re:The bigger they are...

[rpillala]

I don't see anything about it at wikipedia but it was my understanding of credit unions that they do rely on banks for certain things. In that case, are credit unions as a whole exposed to this problem? Can anyone clarify?

http://en.wikipedia.org/wiki/Credit_union

Re:The bigger they are...

[Anonymous Coward]

Weird, last time I checked it was still those local banks that charged you for ATMs, checks, account maintenance fees, etc. They also tend not to have online access, but of course I guess you'd see that as a good thing.

Re:The bigger they are...

[booyah]

funny you should say that,

http://www.umcu.org/

right on the front page of the university of michigan credit union

Member Alert - Phishing Scam
Some of our members have received a fraudulent email from a source pretending to be University of Michigan Credit Union. In this email you are asked to click on a link to provide personal information to "confirm your identity." THIS EMAIL IS NOT FROM YOUR CREDIT UNION. WE WOULD NEVER ASK YOU TO CONFIRM YOUR IDENTITY IN THIS MANNER. Please delete the fraudulent email. If you did click on the link and have entered any personal information, please call us immediately.

Re:The bigger they are...

[__aaclcg7560]

Why don't you check out my credit union before jumping to conclusion. Credit union ATMs are free, I usually buy my checks from an independent check printer, my checking account is free with direct deposit and they pay interest on the balance. Oh, yeah, since this credit union is located in Silicon Valley, they do have online access. :P

Re:The bigger they are...

[crow]

In Massachusetts, there are essentially two ATM networks, and you pay a fee if you use the wrong one.

There's the Bank Boston/Fleet/Bank of America network, and there's the SUM network that almost everyone else has joined.

In my case, my credit union doesn't charge fees for much of anything, and I can avoid ATM fees by avoiding the Bank of America ATMs.

Re:The bigger they are...

[TykeClone]

They are by law supposed to be barred from commercial accounts (I believe) - Credit Unions are supposed to be financial institutions for people of modest means bound by a common bond and because of that are tax exempt and much less stringently regulated than banks.

So some services are supposedly barred from being offered by credit unions, but for consumers they should be fine.

Re:The bigger they are...

[__aaclcg7560]

Everyone and their dogs get emails like that about any bank or credit union. The problems with the big banks losing customer records are due to internal controls (or lack thereof).

Re:The bigger they are...

[MarkGriz]

This is why I switched to a local credit union a few years ago. Seems like the bigger the bank, the bigger the security breach. Worse... they nickel-and-dime you on everything else.

Credit unions are no panacea

Of course, with a building looking like that, and the name "Need Action Credit Union", maybe nobody should be all that surprised.

Re:The bigger they are...

[utexaspunk]

Don't count on it. Credit Unions often outsource a lot of their operations to third-party groups to save on costs. Of course, the way the laws work, one doesn't often have to tell the customer that they are dealing with a third party.

I used to work for a collection agency that specifically did third-party collections for credit unions across the country. We just had an 800 number for each credit union, and we'd answer with the name of the CU depending on which line rang. Same with sending out letters- just change the letterhead accordingly.

If your CU is dealing with the kind of numbskulls I worked with, your data is probably just as insecure if not moreso than if it were with a big bank.

I've been using Washington Mutual for about a year now, and haven't been nickled-and-dimed on anything, and have been really happy with their service. Of course, I'm sure someone will now reply with their WaMu horror story...

Re:The bigger they are...

[frodo from middle ea]

Most ATMs on Cirrus or Star Network will charge 2$ to 2.50$ for ATM Txns , (excluding ATMs of your bank, e.g. if you have an a/c with BoA, BoA ATMs will not charge you).

But my credit union only charges .75$ on all ATMs on Cirrus or Star ATMs, and even that is vavied if I maintain a daily balance

Re:The bigger they are...

[eht]

Actually I prefer the big guys over the one credit union I was with, never had a single problem with Citi or HSBC, but Visions Federal Credit Union (IBM's credit union based out of Endicott area) I've had no end of troubles with.

Nickel-and-dime is all they did, right now I owe them over 40$ to close my 20$ account and the number just grows year after year, I get statements from them, but I just shred them.

Re:The bigger they are...

[Reverend528]

Seems like the bigger the bank, the bigger the security breach.

Well, duh. You're certainly not going to see 600,000 peoples accounts stolen from a credit union with only 20,000 customers. That doesn't mean it's any more secure.

Re:The bigger they are...

[iabervon]

Actually, there are a number of non-SUM banks in MA. US Trust is one, and there's the one with the lighthouse logo whose name I can't remember. You actually have to find your bank if you use one of these and don't want to pay surcharges. It's basically, if you use a Big Bank, you need to use your bank's ATM, and if you use a small bank, you need to use a small bank's ATM.

(Also, SUM is actually a subset of NYCE, not a separate network, and there are other ATMs that charge everyone in certain convenient locations; e.g., the one at Tavern on the Square in Central Square, or the Wainwright in Harvard Square (maybe just one of their machines, though))

Re:The bigger they are...

[Anonymous Coward]

Yeah, someone I know had unauthorized transactions coming out of their account - tried to get them to stop those transactions, and WaMu let them continue.

Re:The bigger they are...

[ignorant_coward]

Well, no bank/credit union exists in a vacuum. My credit union uses various underwriters for selling insurance, for example. Also, I think their stock brokerage is outsourced. The important stuff (my checking/savings) are _not_ outsourced, however.

Re:The bigger they are...

[scaramush]

The phrase you're looking for here is "Security through Obscurity".

Enjoy. :P

Re:The bigger they are...

[twiddlingbits]

My credit union offers business accounts but only to small business that are owned by the CU member. The fees they charge are pretty steep compared to the local bank.

Gee how informative

[tofucubes]

I'm glad to know that about 1 in 10 people were notified
I have a feeling that most people's social security numbers have been harvested by people who shouldn't have them

OMG

[rkv]

OMG i have to go and check and my bank account fast. i feel so violated! so much for piracy. bet they were running windows :angry:.

Re:OMG

[Anonymous Coward]

i have to go and check and my bank account fast.

Don't worry, I've already checked it for you!

Walkoverya is busted omg

[ACK!!]

Time to switch banks.

Crap. I use them.

Man, with inside hack jobs it does not what you are running or what you do, somehow you can still end up getting screwed.

Yikes!!!

Re:Walkoverya is busted omg

[Anonymous Coward]

I know switching banks would be a good old American knee-jerk reaction, but it's really an all-too-common one. Like not going to Wendy's because of the chili thing, like the chances of it happening again suddenly skyrocketed. Sheesh...

Didn't matter, it was an inside job

[varmittang]

"The case has led to criminal charges against nine people, including seven bank employees and alleged ring leader Orazio Lembo, who operated DRL Associates, a company that advertised as a skip-and-trace collection agency."

Sold?

[Zeroblitzt]

Funny how selling bank account information illegally makes money that you'll just have to put back into the bank. Or maybe not.

Banks ? Secure institutions?

[guildsolutions]

Our banks are supposed to be some of the most secure instituions available to us. I wonder if they will reverse the charge on my credit card if I claim I didnt make it and it was caused by my personal information being breeched...

Re:Banks ? Secure institutions?

[gcatullus]

What is scary is that your threshold for getting a charge reversed on your credit card is very low, and you probably could get the charge reversed. I work for a gasoline distributor and almost daily we have someone who denies a charge used at the gas pumps with their credit card. Even if we supply video of the customer, without a valid signature, the charge gets reversed. If you want to make enough of a stink, anything that doesn't have a valid signature someplace can usually get reversed.

Re:Banks ? Secure institutions?

[DavidTC]

See, that's absurd.

The scanners at a pump require a physical credit card, and have no human intervention. That leaves two possiblities:

1) Someone stole their card.

Which is possible, of course, but the CC company shouldn't let them get away with it without saying 'So your card was stolen, then? On the...12th? Alright, we've invalidated it and are sending you a new one, you should should get it in two to three days. And we're reversed all the charges you've made since that point. How odd, it appears someone paid your phone bill with the stolen card, but don't worry, we've reversed it. Hello? Hello? They must have hung up.'

2) The pump billed them and didn't give them the right amount of gas

In which case they should be required to file a police report, because having gas pumps that overbill is a pretty serious crime. (Under the same laws that require correct scales for food and whatnot.) The CC company should inform the customer that they will be alerting the police, and the customer will probably be called as a witness.

However, I suspect the real solution is: If you have tapes of the incident, go to the police with them, and report them for driving off without paying for their gas. In many places, there are specific laws about this. (In my state, you can lose your license.)

Legially, those laws probably don't cover someone who pays and then unpays, or who pays with a rubber check, and they should feel to argue that in court when they get hauled in. ;)

Conflict of interest

[__aaitqo8496]

Customer account numbers and balances were allegedly sold to a man who then sold the information to collection agencies, the Hackensack police department said in a statement. Reuters reports that the information has not been found to have been used in any identity theft schemes.

/snip/

The case has led to criminal charges against nine people, including seven bank employees and alleged ring leader Orazio Lembo, who operated DRL Associates, a company that advertised as a skip-and-trace collection agency.

Hmmm... working for a bank and a "collection agency". Sounds like a conflict of interest banks might want to look out for and possibly stipulate that working for a collection agency is not permitted while working for a financial institution.

Re:Conflict of interest

[Hortensia Patel]

The snippet you quote reads "seven bank employees and alleged ring leader", not "seven bank employees including alleged ring leader". They may all be crooks, but I don't see a conflict of interest per se.

Re:Conflict of interest

[__aaitqo8496]

Point taken.

Unfortunately, I read the snip as meaning the company was run by seven bank employees and one other, as opposed to being run by one non-employee who associated with seven bank employees.

Maybe the journalist needs to go back to grammer class.

Re:Conflict of interest

[Anonymous Coward]

Maybe the journalist needs to go back to grammer class.

You screwed up, just admit it and go on, don't keep trying to blame others.

The case has led to criminal charges against nine people, including seven bank employees and alleged ring leader Orazio Lembo

That's soooo hard to understand.

Re:Conflict of interest

[Anonymous Coward]

Perhaps the journalist will do so once you've gone back to spelling class.

Bank of America is procative

[doyle.jack]

I got an email the other day asking for my card numbers, pin numbers, social security number, etc. so that they could verify that my information had not been compromised.

I'm sure glad I took the time to fill all of that out.

Re:Bank of America is procative

[twd]

Does "procative" mean running the cat command before it's needed?

Hackensack?

[screwballicus]

The data-theft ring may have perpetrated the nation's largest ever banking security breach, a Hackensack, N.J., police statement quoted a Treasury Department representative as saying.

I only hope that Hackensack don't lack the knack to track this crack attack.

Re:Hackensack?

[Reorax]

That is WHACK!

Re:Hackensack?

[Anonymous Coward]

I used to live in the back of a house painted black on a cul-de-sac just off Kinderkamack, a road running through Hackensack.

True story.

Re:Hackensack?

[msensay]

oh yeah, that aint jack. The other day this guy mack kicked me in the sack. Then he stole my identity and wont give it back.

Re:Hackensack?

[msensay]

oh yeah, that aint jack. The other day this guy mack kicked me in the sack. Then he stole my identity and wont give it back.

Re:Hackensack?

[Anonymous Coward]

We heard you the first time.

What about the agencies? Will they face charges?

[stomv]

So, the people at the banks will face charges, as will the Lembo, the "mastermind".

But, what about the 40 collection agencies and law firms? Will they face civil charges? Criminal charges? Both? Surely they knew they were up to no good, and they were the ones funding the information theft in the first place -- all so that they could illegally harass debtors.

Will the Feds follow the money?

Screw identity theft...

[Racter]

...do the police intend to track down the information to and "reclaim" it from the collection agencies, advertisers, etc.?

Laws are reactionary

[paranode]

If an individual or group intentionally leaked or sold this information it is most certainly a crime. Laws are a punishment, not a absolute way to prevent crimes. If the perpetrator is convinced they can get away with this and profit from it, then they are not going to be worried about the fine print of the numerous laws they are breaking.

Does this mean...

[hoovernj]

I guess the hackers (or crackers if you'd rather) dared to dream?

Re:Hmm...

[ZerocarboN]

of course?!?!

after reading article

[tofucubes]

according to the article at least 108000 customers were notified that's about a fifth

Bank of America (up $0.10 to $46.67, Research), the nation's No. 2 bank, has notified 60,000 customers of the problem. Wachovia (Research) has notified 48,000 customers.

Re:after reading article

[Anonymous Coward]

Meanwhile, the phishermen have notified almost 680000 people of the need to verify their information.

Re:after reading article

[Anonymous Coward]

I thought JPMorganchase/bankone was the nations No. 2 bank. The only bank larger is Citigroup.

Wow, your country must be great.

[bigtallmofo]

Based on forensic examination of Lembo's computers, it was determined that he had employed upper-level bank employees to access and identify individual accounts in their respective banks," the police statement said.

It doesn't matter what laws you enact. If you RTFA, you'll see that this was an inside job done by corrupt upper-level employees. Setting aside security-Utopia for a second, at some point you have to trust your own employees, especially "upper level" ones. When that trust turns out to be misplaced, there's not a lot one can do to prevent malfeasance.

Re:Wow, your country must be great.

[CarrionBird]

True, but you can make the companies who have the DBs liable for some the damage they cause. (but not take away from the liability of the actual thief at all)

Re:Wow, your country must be great.

[ezzzD55J]

Setting aside security-Utopia for a second, at some point you have to trust your own employees, especially "upper level" ones. When that trust turns out to be misplaced, there's not a lot one can do to prevent malfeasance.

Well, there's the many-eyes (or something) approach. Certain things can only be done by more than one employee at the same time, so they have to be in collusion to pull of something fishy.

Re:Wow, your country must be great.

[TripMaster_Monky]

This case highlights a need for laws that prevent the offshoring of personal information without a citizen's consent. Had this theft occurred overseas there would be little law enforcement could do in both launching the investigation and arresting those responsible. Even with extradition treaties, it can take years (if ever) to bring a foreign perpetrator to justice. Not to mention the uncomfortable situation of having foreign law enforcement and governments confiscating systems that contain private info of US citizens in the course of their investigation.

Re:Wow, your country must be great.

[Gary Destruction]

The majority of attacks come from within an organization. It could have easily been a disgruntled employee. He might not have received his vacation pay or didn't get promoted like he was hoping, etc.

Re:Wow, your country must be great.

[gmack]

I wonder how many customers would go to a bank that charged double everyone' else service charges in return for being more secure.

I'm guessing most won't.

Re:Wow, your country must be great.

[darkonc]

Security decisions often have to include the fight between ease of use and actual security. When I worked at one ISP, I kept on asking that the user passwords be encrypted -- just on principle. This was vetoed because it would make it harder for the mid-level support reps to compare the typed in (and logged) passwords to what was in the password file.

oh well.

Re:Wow, your country must be great.

[aziraphale]

It does matter what laws you have. The Data Protection Act makes it the company's responsibility to ensure that data is not stolen, even by employees. There's no room for the company to use as a defense "But they're senior employees! I have to be able to trust them!". The law would respond: "no, you have to have protocols in place, or ensure that you don't have the information in the first place, that mean you don't have to trust them."

The very existence of the DPA in the UK forces organisations that are gathering personal information to take responsibility for ensuring that it can't be stolen or abused.

Re:Wow, your country must be great.

[ezzzD55J]

I wonder how many customers would go to a bank that charged double everyone' else service charges in return for being more secure.

I said certain things. Not everything has to be done twice, for many operations (that don't require high access on the employees part) it's possible to secure them technically. Heavens, why am I even explaining this.

Hmm

[Anonymous Coward]

If your bank still charges you fees then you need to switch banks.

Are you also worried there won't be enough tellers for you after you wait in line for an hour to withdraw five dollars for lunch?

Makes you wonder

[TykeClone]

why so many people use the largest of the nation's banks. They aren't inherently more secure than smaller banks and are larger targets because of the number of customers that they have.

There are several thousand smaller banks in the United States and many smaller banks have lower fees than those giants and a customer actually means something to those banks.

Re:Makes you wonder

[LoverOfJoy]

Because their ATM machines are everywhere? I like my local credit union and they are generally good about fees but when I'm out of town and need to use an ATM I get jacked with fees from both the ATM and my credit union.

Re:Makes you wonder

[mOoZik]

Because the bigger banks offer me services that others probably would not be able to. For example, on-line bill paying. For example, 24/7 customer support. For example, an anti-fraud team that helped to rid $600 of fake charges from my account in ONE day after ONE call. For example, branches just about everywhere you go. For example, even with FDIC, knowing your bank is not going to close for whatever reason. For example, knowing that even with such breaches of security, they are a thousand times better than smaller banks. Hey, guess what? That's the same reason I use Windows XP instead of Linux.

Re:Makes you wonder

[Zed2K]

Probably because the larger banks have more of a presence in the towns people live in. I hate getting charged a fee to get to money that is mine from ATM's. Here there are Bank of America machines everywhere. No atm fees, no having to request atm fees reversed.

I've NEVER paid a fee with my BoA account. I don't know how so many people have problems. Free bill pay, free online banking, free bank transfers, overdraft protection, free checking. Hell I even get free checks, not that I write checks anymore though. Only thing I don't like is the horrible interest rate, but thats why I've got a ING account in addition to my BoA accounts.

I've noticed with the small banks (and yes I've looked into them) the online banking sucks, bill pay is a pain in the ass to use and the tellers aren't too bright.

Re:Makes you wonder

[TykeClone]

I'm not sure where you're at, but in the midwest the ATM servicer Shazam has a program where a subset of their ATM's can be surcharge free to participating banks. It's kind of nice to have a small number of ATMs, but be able to offer surcharge free access across several states :)

The fees from your credit union are their decision. They don't need to charge them, but an out of network transaction will cost them more than an in-network one, so they're passing that one to you.

Re:Makes you wonder

[TykeClone]

We rolled out bill payment last year (at no charge) and it seems to be fairly easy to use.

We don't surcharge at the ATM and won't as long as I have anything to say about it.

As far as tellers go, it may be a regional thing...

Re:Makes you wonder

[gcatullus]

One of teh biggest reasons is that these large national banks have become large national banks by buying up the smaller ones. An account that I opened about 20 years ago, has gone through 4 banks. I have never had to change account numbers or anything and I think many people just don't liek change, so they stick with what they have.

Re:Makes you wonder

[The Angry Mick]

Don't all banks belong to the FDIC ('cept, of course, Vinnie the Chin's Savings and Loan)?

Re:Makes you wonder

[Dynastar454]

USAA my friend... if you qualify to be a member that is. They have no ATMs themselves, but they pay you back for any fees you get charged, up to certin limits. Every ATM is free for me. :-)

Re:Makes you wonder

[rsborg]

For example, on-line bill paying. For example, 24/7 customer support.

Large credit unions offer these. You should try really looking for the requirements instead of just assuming that only big banks fit your bill. My credit union's web-banking even allows me to view/download cashed checks... has been very useful to me in proving payment... WellsFargo didn't do that when I decided that their random fees were getting to be too much.

Re:Makes you wonder

[Thurn und Taxis]

I don't know about the rest of the country, but up in Boston I imagine it often happened something like this:

1. Sign up for an account at Arlington Trust Co., a local bank (1987);
2. Arlington Trust Co. merges with Shawmut (1988);
3. Shawmut merges with Fleet (1995);
4. Fleet merges with BankBoston (itself the result of serial mergers) to become FleetBoston (1999);
5. FleetBoston merges with Bank of America (2004).

In other words, these are the world's largest banks because of a series of mergers and absorptions of the world's smaller banks. And once people have their money in a particular bank, it's not always convenient to move it somewhere else. I personally have my money in a small local bank, but if they merged with a larger bank it'd take a pretty serious degradation of quality to get me to switch.

Re:Makes you wonder

[Wile_E_Peyote]

Shoulda modded this funny...

why so many people use the largest of the nation's banks.

If they didn't have so many customers, they wouldn't be the largest banks...

Re:Makes you wonder

[Anonymous Coward]

You might want to read that post again, this time with both eyes.

Re:Makes you wonder

[daVinci1980]

No, not all banks are http://en.wikipedia.org/wiki/FDIC>federally insured.

That's why you should always only go with banks or CUs that claim to be covered by the FDIC.

Re:Makes you wonder

[Urox]

When I cancelled my credit account with them, the phone monkeys didn't understand that B of A was the one that had compromised my data. They kept trying to convince me to just go to a different number. I kept trying to tell them that it didn't matter if B of A was compromised to begin with.

B of A also didn't tell me when they sent my account details to another email address. Fortunately, I owned the domain it was sent to so someone's stupid typo still got back to me. I can bet that they're not telling a lot of customers when they screw up.

B of A also implimented fees to talk to tellers if you didn't have a minimum balance in your account and then a fee for going below that balance.

B of A is screwed up in many ways that you have been fortunate not to come across.

I have no trouble with my credit union. ATMs everywhere, no charges. No stupid phone monkeys so far. Better rates as well. Also online banking. I can even open Roth IRAs over the phone.

Be thankful.

[jd]

It is only very recently that States - like California - require the publishing (even to victims) of this kind of information. Had this happened even a few years back, we'd be none the wiser until we'd all been ripped, and even then the banks would likely claim innocence.

(Those from the UK may recall the curious scandal of "Phantom Withdrawls" from ATM machines, where mysterious, large withdrawls were taking place, even though nobody was apparently present to make those withdrawls. It was unimaginably difficult to prove the vitim was a victim, and even then it was next to impossible to get the bank to repay the money.)

Re:Be thankful.

[Tim C]

Those from the UK may recall the curious scandal of "Phantom Withdrawls" from ATM machines

Something like that happened to a work mate of mine a couple of years ago. A couple of grand disappeared from his account, so naturally he spoke to the bank about it. He convinced them that it wasn't him (in fact, I think they tracked it to Brazil), and so the replaced the money.

A week or so later he had to speak to them again, this time to get them to waive the charge incurred when his account went overdrawn because of the fraudulent withdrawl..

bank of america link

[rogueuk]

Why is there no link to Bank Of America in the summary?

Re:bank of america link

[Anonymous Coward]

Because it's unnecessary and their site woudn't contain any information about this matter?

Re:bank of america link

[rogueuk]

then why bother posting links to any of the banks since none of them have any info

USAA

[SCHecklerX]

I sure am glad that I did *some* time in the service. One would hope that this type of thing wouldn't happen with a bank that serves the armed forces.

Re:USAA

[Anonymous Coward]

Where do you think the govt credit cards which are mandatory for use on govt travel are issued from?

Re:USAA

[Politburo]

One would hope that this type of thing wouldn't happen with a bank that serves the armed forces.

In a sane world yes. However in a sane world one would also hope that our armed forces could act as prison guards without torturing and humiliating their wards.

Re:USAA

[Anonymous Coward]

Ummm...American Express?

Oh, and they're not manditory - I used to travel all the time on my card and got reimbursed later.

Re:USAA

[Homo Stannous]

This kind of thing doesn't happen in USAA because USAA only serves military officers and their families, not enlisted men. It's legal discrimination because it's not on the basis of race, sex, religion, etc. Fortuneately, my Dad was an officer so now I get honest banking and car insurance for life.

Re:USAA

[Politburo]

GP: Well, it's the armed forces running this so I trust there won't be any problem.

Me: Yeah, cause the armed forces are just the paragon of virtue

I'm sorry if reality doesn't agree with your rosy worldview. The "few soldiers" argument is bullshit. Abu Ghraib, Guantanamo, Afghanistan.. thats more than a "few". It's a pattern of misconduct and abuse.

in other news...

[Anonymous Coward]

"BitTorrent is responsible for this terrible identity theft.
We have information that the same individuals who leaked Mr. Lucas' new Star Wars movie, is also responsible for this round of identity theft.
Mr. and Mrs. BitTorrent have failed to respond to our communications, thereby proving their guilt in this matter."
--MPAA Spokesperson

Jail teh BitTorrent!!!

check your accounts

[lambent]

/me scans article ... wachovia, pennsylvania ... shit.

Wachovia says that they sent out letters to everyone they know to be affected. My mail service is spotty at times, so I gave them a call. 1-800-WACHOVIA (1-800-922-4684). Just keep pressing 0 till you get an operator. Their customer service workers were able to tell me over the phone if my account was compromised. It's not. w00t! Took them about five minutes, but I think everyone should double check.

Re:check your accounts

[MarkGriz]

"Wachovia says that they sent out letters to everyone they know to be affected"

Sent out letters?
Welcome to the 21st century, Wachovia.

My bank promptly sent me an email alerting me to the problem, and allowing me to log in (via a secure server) and check my account status immediately. Fortunately my account wasn't hacked.

Re:check your accounts

[Politburo]

Their customer service workers were able to tell me over the phone if my account was compromised. It's not. w00t!

I'm amazed at how Wachovia was able to prove a negative...

Re:check your accounts

[fafaforza]

And fortunately you were technologically savvy enough to check that the link they sent was a legit one, leading to Vachovia's servers. Many do not know where to even begin to do that.

And you're right. Welcome to the 20th century, where requests to "confirm everything," to "update your personal information," or to change your ATM's PIN number because of an information breach can be sent to thousands of mailboxes in an instant, at no cost at all. Sending out a legitimate looking letter via mail, and trying to extract information from the recipient is much harder, takes much longer, and costs much, much more, and more easily tracked down.

Re:check your accounts

[lambent]

Aye ... the logic is specious ... however, I now have on record them telling me that everything is AOK. If it turns out it's not, then hello lawsuit.

I can rest easier at night knowing that "It's Not My Fault©".

Re:check your accounts

[slashkitty]

Trying to figure out if I should mod this funny or idiotic. Of course, now that I reply, I can't mod at all. Doh!

Folks: Don't 'verify' any of your banking info through a link you get in your email!

Re:check your accounts

[op00to]

While you're at it, perhaps you should say 'hello tort reform'! The rethugs are working on closing that little loophole that holds corporations accountable to their customers.

whew

[Himring]

Luckily, I don't use banks. I keep all my money in a thermos under a combination lock. I then tether the combination to a string in a mylor bag and swallow it tying it off on a rigged bicuspid that will send a charge to the bag signaling an incendiary device which will destroy the note unless the tooth is first properly removed. But the bicuspid is fake -- threaded backwards with a one-way screw head. Of course, an anal probe might easily by-pass the oral security, but I recently had my sphincter sewn shut and I only consume nutrient drinks which, by chance, I keep in the thermos....

Re:whew

[Smelly Toejam]

all hail! the king of the losers!

Stop using big banks

[Figz]

My bank offers:

1. Higher interest rates
2. Interest-bearing checking accounts
3. No fees ever
4. Free online billpay
5. ATM fee refunds (since they don't have their own ATMs)
6. Postage paid envelopes for deposits
7. 24/7 Customer Service with almost 0 hold time
8. No BS

I switched to an internet bank a long time ago and I'll never look back. But I'm not going to tell you what the bank is because I don't want it to turn into a "big bank". Go find your own.

Re:Stop using big banks

[Pakaran2]

I wonder about those online banks though... are they insured, or are they located in some island nation of a few hundred people where the local police won't care when the bank shuts down and pockets all the money?

Re:Stop using big banks

[Figz]

Mine is FDIC insured and is located in the US. Like I said, No BS. Do a little research on the best Online Banking and make sure the one you pick is legitimate. Read reviews of it and look at the website. My experience might not be indicative of all online banks.

Re:Stop using big banks

[Anonymous Coward]

I use one. It's 100% based in SLC, Utah. (and no, it's not mormon). It's easier to reach them on the phone than it is most of my co-workers. Usually there is zero wait --- you speak to someone on the first ring. They pay interest on my balance, reimburse ATM fees.

I used to have an account at Wells Fargo but dropped them after they lost 3 deposits within a year. That and the 30+ minute waits to speak to a human being during "unexpected high call volume" --- which seemed to occur daily.

Re:Stop using big banks

[RobertLTux]

and even UPS next day deposit envelopes (if you can get to a UPS POP) oh and btw its based in alpheda(most likely misspelled but...) georgia so no they can't do a cut and run

Re:Stop using big banks

[PureCreditor]

and to deposit money you have to mail them the check? or deposit at another bank's ATM and sincerely hope that the bank of the foreign (not ncessarily outside country) ATM will credit you account.

but all other finances, internet banking is definitely cheaper and better rates, but for checking, I'm still more comfortable having a branch to visit, and knowing that I'm depositing into an ATM machine owned by my bank.

Re:Stop using big banks

[Figz]

All done thru the mail in postage-paid envelopes that they give you for free. In three years, they've never lost a deposit of mine.

Re:Stop using big banks

[Anonymous Coward]

9. ???
10. Profit!!!

Re:Stop using big banks

[Anonymous Coward]

Which bank??

Re:Stop using big banks

[accessdeniednsp]

Wow, my bank has the exact same 'features'. I've switched over totally about 8 years ago and have written about 6 or 7 checks since then :)

It's great.

On an unrelated note, slashdot seems to be doing the "just so you're not a script" routine. Interesting...

Re:Most Banks have poor IT.

[donnyspi]

And by "breading grown" I assume you mean "breeding ground"

10 is a good start

[Nom du Keyboard]

Account information on the customers was illegally sold by bank employees to a man identified as Orazio Lembo

Everyone involved in this should be in jail Now! Ten years apiece is a good start.

And I don't mean Club Fed either.

Re:10 is a good start

[Anonymous Coward]

Throw em in one of those county dumps where you need a shank to fight off the roaches. (You know, the really big ones you worry about carrying you off in the middle of the night?)

I'm really getting sick of this...

[johndierks]

I really feel like that these security breaches are criminal negligence. So far it's been 'All of our customer info has been stolen, we're really sorry."

Holders of mass amounts of critical info need to learn that if they lose it, or mismanage it, that they will be held liable for hundred of millions of dollars in civil penalties, and years in prison for the most egregious cases of negligence.

Re:I'm really getting sick of this...

[Rhys]

But would you be working for them for standard IT salaries if the laws ment it was your backside on the line if some exceptional russian hacker breaks in and steals stuff? Do you really think it's a good plan to have someone else be able to send you to jail with no risk to themselves?

You'd have to be paying me a LOT to convince me that it was worth it. If nothing else, too often those in the trenches who are the first in the sights aren't those who can make the decisions to protect things, or who are told to "make do" with what they have.

No sir, that sounds like a phenominally bad idea from the IT perspective. From any perspective, really.

Re:I'm really getting sick of this...

[johndierks]

I agree that having very strict laws against bodies that hold critical information is not something that should be quickly jammed through congress with no foresight. I also agree that the IT nobodies (like myself) would be the first to have their asses on the line.

But... On the other hand, these companies have libraries full of very valuable data, and they are having a very hard time controlling it. If they need to have the data then they need to be able to protect it.

Once your data has been stolen, it's gone forever. The value of the data is not the actual names/numbers/adresses, but the privacy of those names/numbers/addresses.

I essentially see this as the banks keeping my money on a big counter behind the tellers. Someone runs in, hops the counter and then runs out with a fistful of my cash. "Oops, we're sorry.", they say. Is it the teller's fault what happened? No, but whoever decided it was most convenient to leave my cash (or data) some place accessible better have some answers.

Here's an easy way to protect customer data. Unplug the network cable.

No problems here...

[PenguinBoyDave]

I use a small, regional Credit Union. I had nothing but trouble when I was with Bank of America and Sun Trust (system outages, errors in reporting, etc.) and now this. I think using smaller credit unions or regional banks, while limiting in some cases, is better, because they don't get so big that they forget who their customers really are.

Re:No problems here...

[Anonymous Coward]

Problem is that atm fees are too much nowadays, so large banks with lots of atms are nice.

I know what we can do!

[Anonymous Coward]

Let's make up a "Troll" moderation so that people who post off-tropic tripe to rant about inflammatory political issues can be modded down.

On second thought, let's just mod them Informative.

Re:I know what we can do!

[Anonymous Coward]

I think it was quite on-topic when I posted it.

I was trying to type possible solutions to this problem, and each one I came up with had a problem.

Our government is totally messed up right now. Partisan bickering, massive corruption, business-friendly laws being passed right and left. If our credit is ruined from these thefts of our banking and personal information, we can't even use bankruptcy to escape all of the debt racked up on us because a law was passed that made bankruptcy useless.

So I think I had an on-topic post. Post some ideas of your own for solutions and see how many are even possible now.

For Banks, we do

[TykeClone]

It's called the Gramm-Leach-Bliley act.

It has two purposes - the first purpose is to have financial institutions adopt measures to protect consumer data. The second purpose is to add a great deal of paperwork and extra compliance steps that bank staff must accomplish without adding any extra safety to the information.

I believe that in health care, HIPPA or HIPAA (which ever one it was!) accomplished much the same thing.

Re:For Banks, we do

[The Angry Mick]

HIPPA or HIPAA (which ever one it was!)

It's HIPAA.

Re:For Banks, we do

[Mr. No Skills]

HIPAA addresses this, but is pretty squishy, I believe.

The "law" uses words like "reasonable measures", so there's lots of legal loopholes. And, HHS has not identified an enforcement mechanism, so no government agency has jursidiction on enforcing the law outside of complaining to the secretary of HHS in writing. You'd probably have to sue for damages, but you could do that HIPAA or no HIPAA. I'm also not aware of any reporting you need to do to show you're in compliance.

At least last I checked...

The act itself had got to be 1200 pages in length, at least.

Re:For Banks, we do

[Anonymous Coward]

I believe that in health care, HIPPA or HIPAA (which ever one it was!) accomplished much the same thing.

Yes, in health care, HIPAA accomplished much the same thing, but without TOO much of the bizarre red tape that usually goes into such laws. For instance, insurance claim processes have been standardized now. As a side effect, doctors and hospitals needed to spend money to upgrade their systems and establish contracts with clearinghouses that enabled them to file claims electronically, unless they were "small enough".

In HIPAA's case there was at least a tradeoff made: expense of replacing outdated systems with the benefit of faster payment and less "lost" mail.

Re:For Banks, we do

[TykeClone]

GLB isn't really squishy, but the regulators would rather look at mounds of paper talking about privacy instead of actually seeing that you're being careful about it.

Re:For Banks, we do

[Anonymous Coward]

One big tooth is JCAHO compliance. The inspectors definitely care about HIPAA and can withhold the JHAHO approval for hospitals which is a pretty big deal. It's actually taken pretty seriously (to the point of things being more secure than they were before) where I work.

Can I sell my info before someone else does?

[loggia]

How much are these guys getting?

Like, can I sell my personal information before someone else does?

Re:Can I sell my info before someone else does?

[Teddy_Roosevelt]

Now that you mention it...

Sure, a lot of clear-thinking people get upset to learn their private information has been sold, but I suspect there are also a lot of people who would gladly sell their information for no more than a nominal fee.

I'll bet at least 10% of the population would agree to your getting it all if you offered them $20.

Of course, there's a bit of adverse selection here; the people who would agree to this deal aren't the ones the marketers really want.

Re:Can I sell my info before someone else does?

[swansmt]

Sure. How much are you worth?

Re:Can I sell my info before someone else does?

[Anonymous Coward]

Like, can I sell my personal information before someone else does?

Funny you say that. Once, my phone company (Bell Canada) called me to try and sell me additional services - I declined. Then they began to ask additional questions about my household, income, etc. I asked, "How much are you going to pay me for this information?"

She responded that they don't pay for this information. I said, "Well, if Bell is paying you to call me and ask for this information, then this information has value to Bell. I'm willing to provide - how much will you pay me?"

The call ended at this point. I love fucking with call center people.

Re:Can I sell my info before someone else does?

[bruthasj]

Not sure. It begs the question: can I copyright my personal information and sue for intellectual property theft if someone leaks it out and copies it?

Oh no! Not the Band of America, Wachovie, others..

[bannerman]

How could they! Somebody must think of the children.

It will only get worse

[Amoeba]

This is similar to the Choicepoint breach where account information was sold to an illegitimate company posing as a real customer. The main difference here is that there were "inside guys" who knew the selling of the data was to a bogus firm. What I find most interesting is that the main clients that the perpetrator (Orazio Lembo) sold to were.. wait for it... law firms and collection agencies! Talk about a vicious hive of scum and villiany.

I say it will only get worse because the Sarbanes-Oxley Act is coming into effect which requires companies to put into place access controls to monitor/audit who has access to what information (among other things). The SOX, in conjunction with the Gramm-Leach-Bliley Act are forcing corporations to get their financial house in order in such a way that this type of malfeasance is getting much harder to hide. Expect to see more of the same for quite some time.

While I think it's nice that these laws are having their desired effect I still envy those wacky europeans and their data protection laws.

Amoeba

Glad I opened a new account

[Pedrito]

I have an account with Wachovia. About 6 months ago, I started putting rather significant sums in it. Enough that were the account to get robbed, I'd be seriously upset. What concerned me at the time was that I had used my check card for online transactions, though.

The thought that someone could wipe me out financially by cracking an online system got me worried enough that I opened a checking account at a local bank where I now keep a majority of my funds. I move enough into the Wachovia account for paying bills and stuff that are connected to it, but there's never enough in there to completely wipe me out anymore.

And obviously, with the new bank, I won't be using the check card online. It looks like mine wasn't affected and it doesn't look like the account info was being used for robbery, I still feel more secure with the new account.

Re:Glad I opened a new account

[Anonymous Coward]

I have an account with Wachovia. About 6 months ago, I started putting rather significant sums in it.
Hi, just curious, but how come you started putting away a lot of cash starting about six months ago? Are you saving up? An investment or a private enterprise really pay off? Or just doing well on the corporate ladder?
Anyway in today's credit-card world it seems a bit anomolous to suddenly stockpile cash. Also, you say "started putting" rather than "had to put", as from an inheritance or lottory winning or something, so it seems it isn't a one-off.

Just called BofA....

[tloh]

I was just told that because I live in California and opened my account in this state, my account information should not be affected by a breach in New Jersey, where the incident occured. Can anyone corroborate this?

Re:Just called BofA....

[CarrionBird]

Lol, I can corroborate that BofA is feeding you a load of crap. These types don't admit anything they don't ABSOLUTELY have too.

Re:Just called BofA....

[jandrese]

It depends. Some banks are actually combined into regional bank networks that otherwise operate sepreately. For instance, my buddy has an account a Bank X down the street. When he went across town he discovered that his ATM card didn't work in the Bank X ATM because that ATM was on a different network even though it had the same name.

I don't know if this is the case here, but it is plausable. On the other hand, most bank tellers are competely clueless about stuff like this, so who knows.

Re:Just called BofA....

[Embedded2004]

I just openned a BofA account in California two weeks ago, as I am working here for the next couples months. I am canadian and the one thing that surprises me is how many companies here ask for my social security number. For example my appartment, my bank, my cable company, my cell phone company, etc. Was planning on giving BofA my number once I recieved my SSN card, which will be in around a week. My question however is, why does the bank even need it? Wouldn't the only company I would have to give my SSN to is my employer?

Re:Just called BofA....

[bradediger]

Wouldn't the only company I would have to give my SSN to is my employer?

Technically yes, but companies still have the right to refuse you service until you disclose your SSN. You, in turn, have the right to bank elsewhere... good luck. :-)

Re:Just called BofA....

[e]

Bank of America has separate computer systems for BoA East and BoA West. I too opened my account in CA, but filled out a credit card form with my family's MI address. The result: I had both a checking and credit card account with "BoA", but couldn't see the two in the same online account manager. -e;

Re:Just called BofA....

[ghettoimp]

I think the bank needs your SSN so they can send you tax forms for interest you earn there.

Re:Just called BofA....

[tloh]

Did you confirm this with BofA or is this a guess on your part? Have you considered maybe it is the checking and credit card system that are seperately maintained? Regardless, thank you for the most intelligent reply thus far.

Re:Just called BofA....

[Anonymous Coward]

Are you a BofA employee? didn't think so. I believe you are the one with the crap. Now go fuck yourself with that oversized dildo that passes for a brain. Mod points should not be given to imbeciles. informative indeed.

Re:Just called BofA....

[Anonymous Coward]

Can anyone corroborate this?

Why don't you submit the question as an Ask Slashdot? They post every other inappropriate and stupid question that has no business being asked here.

Sheesh. Do you get your investment advice here, too? Legal advice? Maybe ask a few medical questions, too?

Re:Just called BofA....

[Anonymous Coward]

Taxes. The bank has to report information to the IRS and they need your SSN for that.

Re:Just called BofA....

[Anonymous Coward]

California is a separate system, so it's likely (though not 100% certain) that employees in New Jersey had no access to your data. It would also depend on what part of the overall data flow they pinched it from, though, and I haven't seen any articles that explain what job functions the insiders held.

Yes, I'm an employee. I'm sure you can guess why I'm posting anonymously.

Re:Just called BofA....

[e]

I think I called them about it. The entire system is designed for credit cards and checking (as well as savings, investments, etc issued through BoA) to be managed from the same interface, but it wouldn't take my number as a BoA card. The two separate systems even have different username/password rules. Whereas BoA West will let you choose an alphanumeric username, BoA East requires all numbers. The two systems are almost certainly the reason you have to give your state when you go to log into the account. -e;

Re:Just called BofA....

[Anonymous Coward]

Like above poster said, california is on a completly seperate system than the rest of the u.s.

Re:Just called BofA....

[hoegg]

Since I am a Bank of America customer, I decided to go to their website to read their official statement about the breach. I was surprised to find no mention of the incident. There is a Privacy and Security section as well as a news room.

In the end I decided to ask them about it:

I recently learned that more than 670,000 bank customers may have had their account information stolen, and that at least 60,000 were customers of Bank of America. It is alarming that I can find no mention of the incident anywhere on your web site. It would be reassuring to hear an official company statement explaining the nature and the severity of the breach. Here is the URL of the news article I read: http://money.cnn.com/2005/05/23/news/fortune500/ba nk_info/index.htm

If they reply with anything substantial I'll try to follow up here.

Re:Just called BofA....

[gglaze]

I can verify that claim.

My BofA account was originally opened in Texas. Since then, I've accessed it all over Texas, and also in New York and Cali. When I was most recently in New York, just about a month ago, I had some ridiculous problems with my account - I was trying to get a new ATM card activated, and they had asked me to go into a branch for some reason, and when I got there (in NY), they had to call the Texas branch and do a lot of BS over the phone with them, because they literally had no access to my account from their terminals! They explained that this was due to the fact that in NY they were still on the "old Fleet system" - apparently, branches in NY used to be Fleet bank or something. They explained that the new, fully integrated BofA system was planned to be implemented in about a month's time, i.e. right about now. So I would say that up until very recently, NY (and I would assume New Jersey and much of the east coast as well) have been running on mostly separate systems.

On the other hand, I believe the Cali systems are fully integrated with Texas - when I was in Cali, it appeared that they had no problem accepting my normal deposit slip (as opposed to NY's "out-of-state" deposit slip), and didn't have any other issues quickly accessing and dealing with my account.

Re:What about the agencies? Will they face charges

[Mille Mots]

Will the Feds follow the money? The Fed's *are* the money, so in short, 'No.' (note: I'm well aware that the Federal Reserve is neither)

The DPA requires a proactive approach

[Colin Smith]

Companies are required to put "technical and organisational measures" in place to protect data.

If you can read legalese. The principles:
http://www.opsi.gov.uk/acts/acts1998/80029--l.htm# sch1ptI

Course, I'm not entirely sure how big the teeth are.

Re:The DPA requires a proactive approach

[7-Vodka]

The teeth seem to be big enough since every company that I know regulated by this law is changing it's practices. (that's pretty much every responsible buisness)

Re:The DPA requires a proactive approach

[hedora]

Forcing companies to delete unneeded data and preventing them from reusing consumer data in unauthorized ways are two great steps forward. These policies have great security benifits, and come close to forcing marketers to use 'opt-in' schemes. They also prevent information from being misused in unanticipated ways in the future.

I wish the US constitution considered privacy to be a human right like the rest of the free world does.

Time to sue these companies out of existence!

[Anonymous Coward]

This is ridiculous, there is another story of 500,000+ people's data being stolen. How many have to happen before my institution is affected.

Re:Native Americans: An Absurd Liberal Myth

[Anonymous Coward]

They were invented by radical leftist agitators at Berkeley in the early 1960s

Tell it to Chief Thundercloud.

So I Log on to Wachovia's Site and See This...

[judmarc]

Customer Protection

Guard yourself against fraud and identity theft. Wachovia provides the highest levels of protection and stands ready to assist you should you become a victim.

Irony, anyone?

Credit Unions

[Clay Pigeon -TPF-VS-]

And this is why I keep all my money in a credit union. CU's are generally too small for this sort of thing to happen, and you get better rates with them as well (generally speaking).

Go after the "clients" too

[Wansu]

"That information was then sold to his clients, which included more than 40 law firms and collection agencies."

I don't know whether the 40 law firms and collection agencies are criminally liable but if they ain't, they oughta be. An example should be made of them. Yes, those taking the data bear the brunt of the blame but the ones purchasing it have some culpability too.

Re:Go after the "clients" too

[Anonymous Coward]

Please allow me to point to the part of the article that mentions "Phase Two".

This puts the numbers...

[hoka]

Over 5 million. 5 million persons that had their personal information compromised in some form in the year 2005 alone. The Privacy Rights Clearinghouse is going to have a field day with this on their website.

They can have it

[Anonymous Coward]

Tell you what, they can have my info...
Someone stealing my identity might actually improve my credit

Re:Most Banks have poor IT.

[timmyf2371]

Of course, because personal data cannot be deliberately illegally copied using other operating systems, right?

Horrible

[get out of debt]

You spend so much time worrying about how people steal your information from your mailbox, but when it comes down to it most of the fraud is probably being purpotrated in the back rooms like this one. Can't wait to see how this one plays out.

The DPA requires a proactive approach

[Colin Smith]

Actually, a lot of UK companies don't realise this yet either.

But the DPA requires:

"Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data."

Great, another new law to ignore.

[crovira]

These things are less effective than 'Orders of Protection' from someone who's determined to cop your sh*t.

Securing your sh*t is the only viable alternative. But its an uphill battle with all the idiots out there trying to sell it.

Bah.

Re:Great, another new law to ignore.

[Anonymous Coward]

oh man f**k that sh*t.

Re:What about the agencies? Will they face charges

[4Runner]

Feds said that was part of Phase 2.

"Lomia said the law firms that allegedly sought Lembo's services are part of "phase two" of the investigation."

Re:I am NOT a script.

[Anonymous Coward]

I azm NOT a sczripzt.

Fo shizzle snoop, get off slashdot already.

A simple solution

[Anita Coney]

Some states allow citizens to block use of their credit report. Thus, even if someone steals your SSN, your birth certificate, and your drivers license, they're unable to obtain any new credit in your name, because no one is going to give credit without first getting a credit report.

Sure, it doesn't solve all problems with ID theft, but it certainly helps.

Re:A simple solution

[polysylabic psudonym]

Um, if they've stolen enough of your ID to get credit, surely they've stolen enough to get your credit report released.

BoA just the NE?

[RomulusNR]

I just called BoA, and they told me that the incident was "mostly contained to accounts in the Northeast".

Anyone receive conflicting information from them on this?

Re:BoA just the NE?

[Anonymous Coward]

They didn't even know about this incident when I called. They thoguht I was referring to the security violation a few months ago (not related). I told her to go to CNN to view the article.

Corporate tree to replace ladder

[0xABADC0DA]

Is there some place on the .net where a person can get an overview on what company owns what other companies? I know that First USA was taken over by Bank One and then by Chase in like less than a year. They could all be owned by one of the affected banks for all I know!

How can anybody reasonable know these things? Is there a www.CorporateTree.com or something?

Re:Corporate tree to replace ladder

[Anonymous Coward]

uh, Bank One bought FirstUSA 8 years ago. The Chase merger happened last year.

Usually, the corporate websites have history crap that you can read to if you don't feel like spanking the monkey on a dateless night.

It's not perfect, it can be made more difficult.

[khasim]

If you RTFA, you'll see that this was an inside job done by corrupt upper-level employees.

Yep.

Setting aside security-Utopia for a second, at some point you have to trust your own employees, especially "upper level" ones.

Nope. It shouldn't be that hard to have every employee's access to every account logged.

Then, you have those logs checked by another person, not at that location. Was there a legitimate reason for the access (withdrawl/deposit)? Was that access initiated by the customer?

The people monitoring the logs will not have access to the personal information of the accounts.

Now, if the logs are checked on a random basis (Joe is NOT the only person who checks all of Seattle's logs) then that activity is much easier to spot.

When that trust turns out to be misplaced, there's not a lot one can do to prevent malfeasance.

The key is to build a system where individuals are NOT allowed unchecked access to personal information.

The reason we don't have systems like that is because there isn't any financial incentive to implement them.

The US does NOT have the same privacy laws that other countries have so this kind of activity is MUCH easier to get away with.

Re:Most Banks have poor IT.

[Fade_to_Blah]

This had nothing to do with technology...some hire ups at the bank stole the data and sold it off to a very high bidder. It doesnt matter what operating system you have...that data was going out.

Re:What will it take?

[stlhawkeye]

Oops, I forgot Bush ruined class action lawsuits by forcing them to be in federal courts, which are more friendly to businesses.

I don't like Bush's policies either, but let's not just make things up, ok? First, not all class action suits are "forced" to federal court, only very large suits.

Second, they're moved to federal court not because federal courts are more business-friendly, but because of procedural differences in state court vs federal court. State courts tend to be more relaxed in due process procedures, and award ridiculous damages that are confiscated by private law firms. The ease with which a class action suit can be won in a small jurisdiction for enormous rewards has caused capitalistic law firms to seek out groups of marginally damaged people and organize them for a suit. This has caused a tenfold increase in class action lawsuits over the last decade.

Meanwhile, plaintiffs from multiple states with complaints against the same defendant could not organize on a federal level and file in federal court, due to procedural restrictions that prevented class action suits from being moved out of state. Thus you had the dangerous situation of one state's courts determining a case that would have national prescedent ramifications, and this seriously violates the principles of federalism. For a guy who bitched in his post about removing checks and balances, you're also complaining about legislation that was intended to prevent one state from determining national policy via state courts that are cherry-picked by millionaire attorneys.

The legislation in question removed some of the roadblocks to moving large cases with multistate plaintiffs to federal court by granting original jurisdiction of a case to the District Courts instead of the state courts for large suits in which there are multistate plaintiffs.

You then characaterize all this in your tired anti-Bush ranting as some pro-business move that Bush enacted for his cronies. First, that's not how a bill becomes a law, and you ought to know that by now. Presidents do not sponsor legislation in committee, nor vote on them in congress. They sign them.

There are a shitload of legitimate things to criticize President Bush about, but I'm tired of this hate-filled ranting that's misinformed. It's really hard to push for social evolution and progress when most of the people on your side are ignorant and more concerned with politics than anything else.

Oops, I forgot our legislature is too busy removing checks and balances (Senate) and debating corrupt members (House) to get anything else done.

I'm not sure what you're talking about here, so I can't really respond to you. The only major battle I know of in the Senate is over appelate court nominations, and I haven't read anything yet about changes to how nominations are handled.

Credit Unions

[N8F8]

Banks are evil. Use Credit Unions.

zerg

[Lord Omlette]

Has anyone here received these notifications? What do they look like? Is it a separate envelope saying, "Your data may have been compromised, follow these procedures, shred these documents, take these precautions in the future. Please." Or is it a single line at the bottom of your monthly bank statement?

How do you reclaim it?

[khasim]

You'd have to wipe out all of their hard drives and tapes.

But that would, effectively, destroy their business.

Not that I, personally, have a problem with destroying their businesses, but I see long running court cases over it.

Re:How do you reclaim it?

[grolschie]

How do you reclaim it?

Blonde logic: You simply return it to the original owners.

Big Bank Leach

[NotQuiteReal]

I am a big bank "leach".

I use a "big bank", but as far as I can tell, they make no money off me.

Everything I do with them is "free" - free checking, atm use, etc.

Whenever I have excess money in the bank, it gets swept into an online bank account that pays decent interest, or I send it off to my brokerage account where I gamble it away on bad stock picks ;-)

I buy my checks from random cheapo check printers.

As far as I can tell, I get the benefit of the big bank (lots of atms, grocery store locations, etc) and if anything should happen to my account, security-wise, it's their problem, not mine.

Re:Big Bank Leach

[CrazyTalk]

Believe me, they are making money off of you for every day that you have a single dollar in their account. Your money isn't sitting in a big vault somewhere - it is being re-invested by the bank at a much higher rate of return than they pay out to you.

Does this mean...

[nightskier]

that I should start responding to all those "Wachovia Bank Confidential Information" emails?

Well, shit.

[Grendel Drago]

I have an account with one of those banks. And they've been rather good; their phone service is excellent, their web system is better than average...

Bah. So what happens now? I wait for the junk mail to start pouring in? This is... infuriating. Is there someone I can throw tomatoes at?

--grendel drago

Something important to note

[SkankinMonkey]

It's very important to note that their actual accounts were not compromised, only personal data and account numbers. While - yes, this is horrible, it's more of an "You asshole" issue than an "Shit, I better make sure all my money is there" issue.

Market reaction...

[jea6]

Doesn't seem like the markets find this too interesting:

Bank of America (BAC): 46.61, +0.04 (+0.09%)
Wachovia (WB): 52.24, -0.18 (-0.34%)
Commerce Bancorp (CBH): 29.06, +0.44 (1.54%)
PNC Financial Services (PNC): 55.26, -0.15 (-0.27%)

Re:Market reaction...

[Mr. No Skills]

I think its all part of the cost of doing business at this point.

The sad fact is that identify theft is a major disaster to some individuals, but is just noise to the banks themselves. Like shoplifting in retail. They won't do anything about it until some other bank solves the problem and customer flock to them. But, many customers don't even know who their banks is anymore between consolidation and on-line banking.

What angers me the most is when I get a solicitation for a credit monitoring service for them to protect unusual activity. These guys created this mess where they'll open a line of credit for anyone without identification, and now they want to charge us to help protect us from them.

The mob would probably be in this business if it wasn't so morally distasteful.

Interesting Coincidence

[The Angry Mick]

A while back I got a call at around 4:30 P.M. from a credit card company requesting that I verify I had applied for a Home Depot card via one of those "just sign the line below" forms. I hadn't, so I immediately began the tedious process of requesting credit reports and contacting my bank to check up on unusual activity.

Later, at about 7:00 P.M. the same night, I got an pre-recorded call requesting that I call an 800 number and reference a specific "case code". I wrote down the telephone number and the code, and the next day spent a few minutes on Google shagging down the number. Turns out it was for a law firm in Utah that specialises in handling collection cases (unfortunately, I cannot remember their name). I remember thinking, a) "I don't owe anyone any money" and b) "how in the hell did they get my number?".

Now, I guess I know.

The story ended well for me - there were attempts to steal my identity, but they were all apparently stopped. I never did call the collection firm, so I have no idea what they may have wanted to chat about - seems to me if it was important, they would have used a human instead of a tape. The links I followed from Google were mostly to blogs and forum entries relating to how other folks had recieved similar calls from this agency, and upon returning them had been informed by the collection agency that they owed some form of money to an bank/credit card company they were representing. The kicker was that they also tried to add an additional fee (some as high as $275 US), payable to the collection agency alone. Other links mentioned how this same company had been banned from business in a lot of states for trying to add this extra fee, and, in essence, refusing to clear the original debt until their extra fee had been paid.

Re:Interesting Coincidence

[zerbot]

There's at least one other person out there with the same first and last name as me that has welched on some debts, and I've gotten calls from collection agencies trying to collect. Some of them were polite and just took my word that I was not this person, and some were obnoxious and wanted me to give them all kinds of information like my SSN, DOB, and such to "prove" I wasn't this person. They can take a hike.

Bank of America again?

[MS]

Is this the same bank: SQL Slammer worm shines light on Banking?

I'm glad I do no business with them.

Fortunately, my bank acct info is a catchy tune

[Anonymous Coward]

I'm sending out the RIAA to punish the BofA for copyright infringement.

Re:Fortunately, my bank acct info is a catchy tune

[colinrichardday]

You're kidding, right? Even SCO isn't stupid enough to sue BofA.

Got fired for reporting insecure loan apps...

[RayMetz100]

My old bank fired me for reporting that all daily loan applications including first and last names, social security for borrower and co-borrower and full addresses were wide open on an unsecured windows fileshare with everyone/full control access. All 50,000+ bank employees plus contractors with any windows domain login had full access to view all daily loan applications. These poor people weren't even our customers yet. I knew my manager would do nothing about it, so I started with a standard IT helpdesk call. At least then my report would be logged. Nothing happened. I then tried several other channels and after a few days, I found the "dept in charge of keeping us off CNN". They immediately secured it and were very thankful of my report. Since I had also noticed many other unsecure servers in my time there like daily intra-bank mortgage trade activity and others, I proceeded to report over 15 servers to this group. They fixed everything I reported and were thankful. They advised me not to scan their network because that would be considered hacking, but if I came across unsecured servers over the course of my normal work, I should report it. All was fine until some other managers got back to my manager asking who was the busy-body in his department causing them this extra security work? At bonus review time, my manager all of a sudden gave me poor ratings, disqualifying me from my $6000 bonus. He had given me an out-of-cycle raise just 5 months earlier for good performance. Go figure. After no raise and no bonus, I was pretty ticked and started escalating the issue with his manager and the nice security group. No response. I then put in for a transfer. My manager then writes me up for a written performance issue, listing security as one of the issues, and made my transfer ineligible for 90 more days. I continued to escalate but a few weeks later, he fired me for not addressing the "performance" issues. I've thought about finding a lawyer, but I'm much happier with my new employer now and try to just let it go. Ray

Re:Got fired for reporting insecure loan apps...

[SysKoll]

Good grief, man, how can you let these people treat you like that? There are laws to protect whistleblowers. Your old boss attempted to cover up a series of huge blunders that could have potentially cost the bank millions in liability, not to mention lost goodwill. Firing a whistleblower who documents an irregularity is a Federal offense.

Get a lawyer and sue the morons 'til their ass bleeds, THEN call the medias for good measure. Sit back, enjoy. Then, for the next few years, make sure to stop every morning for donuts at the next employment place of your ex-boss.

It's much more rewarding that setting the place on fire.

Re:Got fired for reporting insecure loan apps...

[kongjie]

There are laws to protect whistleblowers, but in order to prove that you were fired for whistleblowing and not for other reasons, you had better keep detailed records refuting any claims made by management during performance reviews and the like.

My girlfriend has made a sexual harassment claim against her boss in the past; not only did the claim go nowhere (because said boss is worshipped by his superiors), but now that more than a year has passed, she has received a poor performance review, on the basis of dubious yet difficult-to-refute statements. She too has decided to move on to another company rather than try to fight.

Look at the header

[Yurka]

"Band of America"?

Sucka!

[Grendel Drago]

You would trust any email with a link to go log in to your account? Man, I'm amazed you have any money left to check on!

--grendel drago

Re:Sucka!

[MarkGriz]

WHOOOOOOSH

How Fight Club.

[fdawg]

Next, I'll walk outside and see my car covered in bird poop.

Your worries are (largely) unfounded

[Anonymous Coward]

I work for a bank in New Jersey (that wasn't compromised). We received information about this a while ago. As I recall, bank employees were paid to provide information about specific individuals sought by collection agencies, which they would find by scanning lists furnished by these agencies and checking to see if the individuals were depositors with the bank. If you're not being sought by a collection agency, the odds are low that your information was compromised.

Bank of America only recently started operating in New Jersey, with the acquisition of Fleet. So I would assume that former depositors of Fleet as well as those who've opened accounts at area branches since the acquisition are vulnerable (as well as depositors at the other affected banks, obviously), but probably not Bank of America customers in other parts of the country.

Got fired for reporting insecure loan apps, try 2

[RayMetz100]

My old bank fired me for reporting that all daily loan applications including first and last names, social security for borrower and co-borrower and full addresses were wide open on an unsecured windows fileshare with everyone/full control access. All 50,000+ bank employees and contractors with any windows login had full access to view all daily loan applications. These poor people weren't even our customers yet.

I knew my manager would do nothing about it, so I started with a standard IT helpdesk call. At least then my report would be logged. Nothing happened. I then tried several other channels and after a few days, I found the "dept in charge of keeping us off CNN". They immediately secured it and were very thankful of my report.

Since I had also noticed many other unsecure servers in my time there like daily intra-bank mortgage trade activity and others, I proceeded to report over 15 servers to this group. They fixed everything I reported and were thankful. They advised me not to scan their network because that would be considered hacking, but if I came across unsecured servers over the course of my normal work, I should report it.

All was fine until some other managers got back to my manager asking who was the busy-body in his department causing them this extra security work? At bonus review time, my manager all of a sudden gave me poor ratings, disqualifying me from my $6000 bonus. He had given me an out-of-cycle raise just 5 months earlier for good performance. Go figure.

After no raise and no bonus, I was pretty ticked and started escalating the issue with his manager and the nice security group. No response. I then put in for a transfer. My manager then writes me up for a written performance issue, listing security as one of the issues, and made my transfer ineligible for 90 more days. I continued to escalate but a few weeks later, he fired me for not addressing "performance" issues.

I've thought about finding a lawyer, but I'm much happier with my new employer and try to just let it go.

Ray

This is why Closed Source is the way to go

[WillAffleckUW]

After all, problems will be found without any problem and fixed in a timely manner.

Um, why does my bank statement have a check for $6,587.21 to LEET Enterprises on it? ....

It's deja vu all over again!

[Thud457]

If this keeps up, pretty soon we'll all be using the same identity!

Quis custodiet ipsos custodes? -- aparently a blind drunkard that's easily bribed.

Customer Data Protection

[natoochtoniket]

We clearly need a law to give the corporations that hold personal information some incentive to prevent theft of that data. The law might set requirements for particular methods that are needed to prevent data theft, but for any particular methods there will be hacks that can get around them. IMO, the key is to hold the officers liable for the theft.

Suppose the officers and directors of a corporation were to be held criminally liable whenever personal data in the custody of that corporation is used to harm the person or steal his money.

That law, by itself, will not stop data theft. But, it will give the officers and directors an incentive. A few dozen corporate officers and directors will go to jail for 20 years each. Then, immediately, all other corporations will do whatever is necessary to prevent data theft.

Be Careful.

[kannibal_klown]

The thought that someone could wipe me out financially by cracking an online system got me worried enough that I opened a checking account at a local bank where I now keep a majority of my funds. I move enough into the Wachovia account for paying bills and stuff that are connected to it, but there's never enough in there to completely wipe me out anymore.

About a block from my house there's a small bank. It had a recognizable name, but not a major one. The building was small and it was run by locals. I had a small account in there to save up for college spending.

Anyway, about 2 years after I opened my account there was a small scandal. One of the owners was caught skimming funds from a number accounts; not wiping them out perse, but $100 here, $50, %300 there (depending on how big the account was).

So, there's no gaurantee. However, what you're doing should provide some comfort, as if someone got to your check card or whatever you wouldn't lose everything.

I send this letter for your approval...

[Thud457]

Checks your bank account... SHIT! I paid good money for this stolen personal information, and they're all deadbeats!

Re:It's not perfect, it can be made more difficult

[srleffler]

At some level, though, it becomes just a cost/benefit calculation. The kind of security you describe sounds like it would be expensive to implement. Companies might well decide to stick with the tried and true approach of not implementing such a scheme, taking whatever fines they get when a leak occurs, and arranging {fines|lawsuits|jail} for the employees responsible. While not perfect, this approach may well be almost as effective and cheaper in the long run.

New Bank of America advertisement

[Excelsior]

"It's not about selling sixty-thousand members' personal information. It's about selling one members' personal information, and then repeating the process 60,000 times."

From the Yahoo Article:

[Glowing Fish]

In a separate case with the potential for identity theft, a laptop containing the names and
Social Security numbers of 16,500 current and former MCI Inc. employees was stolen last month from the car of an MCI financial analyst in Colorado, said company spokeswoman Linda Laughlin.

The car was parked in the analyst's home garage and the computer was password-protected, she said. MCI would not comment on whether the data was encrypted.

The Yahoo article mentions this, although the Slashdot article doesn't.
I bring this up because this case at least seems like a computer security issue, as oppossed to a human nature issue.
If the laptop data wasn't encrypted, all you need to do is mount its harddrive on another computer. That is hardly an arcane or technical procedure, and the article should mention how easy that is.
Personally, I think laptops are mostly good for watching funny flash videos with your friends in trendy coffee shops. You should never put important data on a laptop, and then lug it around.

Re:From the Yahoo Article:

[petermgreen]

many laptops set a hard disk password when you set a bios password

getting round that is not trivial. Probablly possible but probablly a job where a speciailist data recovery firm would be needed. (you either need custom firmware OR you need to wipe the protection info off the platters AND replace the controller board iirc)

Why the hatred of the blind?

[Anonymous Coward]

I work at a school for the blind in Spartanburg, SC, and I just stopped in to see why I've received so many complaint calls about this site today. I see what the problem is now. Blind users are told to go screw themselves by the people that run this site. The state of SC has been looking for a high-profile web site to take to court over the ADA, and I've found the site I'm going to recommend. I hope you get nailed to the wall for this. It is not only illegal, but it is wrong.

Re:Why the hatred of the blind?

[Anonymous Coward]

The state of SC has been looking for a high-profile web site to take to court over the ADA, and I've found the site I'm going to recommend. I hope you get nailed to the wall for this. It is not only illegal, but it is wrong.

If you're talking about Slashdot, you're seriously confused about the law. A privately owned website doesn't have to make any accomodations for the disabled whatsoever.

Re:Why the hatred of the blind?

[Anonymous Coward]

> A privately owned website...

Many people disagree with that opinion, including the majority of state AG's. This hatred of the disabled needs to stop.

Re:It's not perfect, it can be made more difficult

[Anonymous Coward]

Nope. It shouldn't be that hard to have every employee's access to every account logged.

I worked at a large financial institution (life insurance, in a branch of a bank. Hell what I'm saying is 100% accurate so let me say that I'm talking about RBC Insurance - Life, whose offices are in Mississauga, Ontario) a while back, and had full access to hundreds of thousands of customer's data, including specially separated "high net worth" clients. I looked around and realized that on any of the developer PCs (where the user was admin. Actually these morons set DOMAIN\Users as admins, which meant that there was no PC to PC security and any hack could occur by co-opting a coworker) a USB key or PDA could siphon off everything.

Realizes how insanely loose the controls were, I proposed initiative after initiative to tighten up the system, and to add some sort of read logging, but I learned firsthand that financial institutions, presuming this one was par for the course, are 95% politics, and 5% actual concern about customers. The only way any sort of checks and balances were going to be implemented is if it properly gave a handjob to every useless mid-level manager planning their next Machiavellian maneuver (and successfully ensured that I didn't look good out of it, as a shop like RBC is configured in such a way that only the mediocre persist. If you look good, the next time a management churn occurs some clueless twit will purge the clueful). It really was eye opening, and the status quo was maintained and everyone acted like nothing was wrong.

Of course you really have to work in a place like that to fully appreciate how terribly incompetent such organizations are, and to maek it more fun they churn their management around with no logic or thought. Remarkable stuff.

Re:It's not perfect, it can be made more difficult

[bigtallmofo]

I agree with a lot of what you said. However, you will never have perfect security and to hold companies to a standard of perfection is unrealistic and unfair.

Nope. It shouldn't be that hard to have every employee's access to every account logged.

OK, what about an employee that installs a hardware keystroke logger onto a shared computer and runs the illegal reports under other employees' accounts? For every point you bring up, there is going to be a way around it. Admittedly, for every way around something, there's going to be a more secure counter measure. Which there is a way around. Which there is a counter measure for. (repeat forever)

Hold companies to a reasonable level of security, sure. Don't expect perfection from an imperfect system in an imperfect world, though.

Luxembourgish banks are safe

[Anonymous Coward]

Most major Luxembourgish bank use a system where in addition to your password, you have to enter 3 digits whose position is randomly from a card of 16. That way, even if a thief snoops the transaction, he's only got 3 digits from the card, and he will need to retry very often until those 3 come up again.

Re:It's not perfect, it can be made more difficult

[Anonymous Coward]

Ha! I also worked at RBC in a different division until the purge a quarter year ago. I'll definitely agree with what you said about incompetence.

For those who don't know, RBC did a purge where they cut 1800 or so employees in late 2004 and early 2005. They hilariously immediately put want ads out for almost all of the positions.

Here's the funny part...every employee that they cut, at least those that I saw (which was a large number), were white, Canadian born non-managers. Basically it was, or such is my impression, a Great White Purge. This allowed them to both restock with low paid immigrants that will dance and act grateful for every dime thrown their way, as well as improving their so-called "diversity" to help disguise the fact that mid- to upper-management is almost entirely classic white males.

RBC is a shithole. They paid a nice severence though.

Re:It's not perfect, it can be made more difficult

[Anonymous Coward]

Oh I should clarify one thing...white born-Canadians were actually already fairly rare in non-management positions at RBC before the purge, so the fact that the purge hit that group the most was really revealing.

Economics

[mslinux]

Perhaps once everyone has had their identity stolen, the value of a stolen identity will be zero. Just be sure to take steps to prove you are who you say you are now (get a copy of your birth cert notarized, get a concealed handgun permit for the background check, etc.)

Re:What will it take?

[Anonymous Coward]

Oops, I forgot our legislature is too busy removing checks and balances (Senate) and debating corrupt members (House) to get anything else done.

I'm not sure what you're talking about here, so I can't really respond to you. The only major battle I know of in the Senate is over appelate court nominations, and I haven't read anything yet about changes to how nominations are handled.

Where have you been?
Senate
House

Do you live in the USA?

Re:It's not perfect, it can be made more difficult

[soft_guy]

The reason we don't have systems like that is because there isn't any financial incentive to implement them.

The reason we don't have this is because, in the USA, the crooks are writing our laws.

Encryption value?

[grahamsz]

I've often wondered what the point of encrypting customer information is if it's part of an online system.

I've often heard the suggestion that websites should encrypt their user database, which is great except for the fact that (sparing hardware encryption devices) they must also store the key. Hence anyone that steals the data can help themselves to the key too.

Surely its much better to keep the information on a secure backend system and have a closed interface for webservers to talk to it?

Re:Encryption value?

[cyways]

In at least a couple of cases I can recall, the information was obtained by stealing magnetic tapes with customers' data that were being transferred by air. For instance, this story
http://www.montereyherald.com/mld/mcherald/2005/05 /03/business/11551144.htm
concerns "misplaced" computer tapes containing personal information on some 600,000 TimeWarner current and former employees. From the article:

"Iron Mountain [a secure records storage firm] last month issued a press release urging companies to use encryption software to scramble their backed-up data files. Data stored in this manner is almost impossible to decode without a special key.

But a recent survey by the Enterprise Strategy Group, a research firm in Milton, found that the majority of companies don't encrypt their backup files. Jon Oltsik, a senior analyst for the group, said recent data-security problems are causing many companies to begin taking encryption more seriously.

The latest security problem has made a believer of Time Warner. McKiernan said the company will begin installing a system to encrypt future backup tapes."

Stolen unencrypted tapes were also involved in the earlier disclosure of Bank of America records on over a million government workers.

Re:It's not perfect, it can be made more difficult

[s.fontinalis]

I've heard very similar stories from Wells Fargo stateside. No data security, no personal record security. It's a lawsuit timebomb.

You're joking, right?

[HangingChad]

Then, you have those logs checked by another person, not at that location. Was there a legitimate reason for the access (withdrawl/deposit)? Was that access initiated by the customer?

PAY someone to do access security? ROFLTIPMP! Not until there are massive fines for data breaches is anything like that going to happen. And with this administration in office you can forget that.

I'm surprised Bush doesn't figure out some way to reward them for having your indentity stolen. As it is there's absolutely no down side for Chase, except some minor embarrassment. The credit monitoring is a largely symbolic effort aimed at trying to keep their customers from stomping off in disgust.

lol. Nice pipe dream, though.

Re:You're joking, right?

[twiddlingbits]

Get off the political BS, data/Identity theft has occured for years way back to Clinton and beyond. It's just that some high visibility cases have occured and the press is all over them. There have been chances for CONGRESS to pass data security laws for many years. Just wait to one of the Congress critters gets THEIR identity stolen then you may get some laws.

Oh *great*

[MisterE]

My bank, Commerce, is one of the offenders. I checked their website and this is all I find in the "news":

05/12/2005
Commerce Bank Launches Summer Reading Program with Readings in Four States
05/05/2005
Commerce Bank Launches Online Banking Site and Service Entirely in Spanish
04/19/2005
Commerce Bank Appoints Eric Pietras to Lead Government Contractor Lending Team
04/14/2005
Commerce Bank Supports Majority of Local March of Dimes' WalkAmericas
04/13/2005
Commerce Bancorp Net Income Up 24%

Not a damn thing about their (our - potentially MY) data breach. Oh, but they sure rake in the cash!

I'd like to see us have the ability to remove our data from places like ChoicePoint and Lexus/Nexus. It should be, afer all, MY data and therefore MY property. Until there is sufficient penalty for this type of carelessness I want my private data to remain private!

value, protection and economics

[slew]

The way I see it, many of the companies that collect personal information, (banks, radioshack, etc) see little or no value in the information they are protecting, it's only their value of reselling it (e.g., like a pawn shop). As a old tired example, why does radioshack need a phone number when you buy a battery?

IMHO, the goal should be to make economics work for us. The cost of them collecting and securing it should balance the value the get from selling it. Then if the expected return on investment is zero, why would they even bother to collect it? It's just because right now it costs them little to collect it and they can resell it for more is why they do it right now.

One way to get this to assign big penalties to losing control of the info so that the expected cost is high. Another way is to just bill them up front (e.g., tax companies for collecting the information). I'm guessing that in the end, some combination of things would be optimal.

Another thing to look at is to licence people (not companies) to handle information. For example, it takes a registered notary public (not a flunky that the bank assigns) to witness signatures on major business transactions. Why can a company assign some skript kitty to process social security numbers? Why should a bank VP have any access at all? Getting notary public certification is trivial for anyone with a 1/2 a brain, but they make it very clear that your butt is on the line, not the company's butt, so most of them take it pretty seriously. Something about a few hours studying for a test and a name on a license and some personal responsibility makes most folks take their jobs less like a joke (although you occasionally get the rougue CPA or notary, it isn't very common)... Maybe it's time for a certified public information collection certificate or something like that...

Anyhow, that's just food for thought...

Re:value, protection and economics

[Anonymous Coward]

When a clerk asks for personal info from me I politely decline. If they say they need it to complete the transaction, I tell them no again and leave. Simple as that.

I also wear a tinfoil hat and pay for everything in small unmarked bills.

Re:value, protection and economics

[Anonymous Coward]

I've always given RS the local police's non-emergency line ;)

Re:value, protection and economics

[hairyfeet]

IMO a better idea based on something like the do not call.NO i do NOT want my information collected by any company for the purpose of marketing.Yes i understand that by opting out i will limit my chances on credit cards by non bank affiliated companies.If we can choose not to have telemarketers play with our phones,Why can we not choose to have them not play with our data which is much more valuable?

Re:value, protection and economics

[Decker-Mage]

Precisely; we are back to externalities again. When the bank, credit bureau, or other collector of information screws up, the externality here is the damage inflicted on the individual; it doesn't happen to the company that held the information. The only way to fix the problem is to reflect the external costs back on the institution or corporation. Unfortuately, I'm also pragmatic. Given how many legislators have been bought and sold by these institutions/corporations, we won't ever see a change in this situation.

"When buying and selling are controlled by legislation, the first things to be bought and sold are legislators." -- P. J. O'Rourke

Re:value, protection and economics

[berzerke]

...it takes a registered notary public (not a flunky that the bank assigns) to witness signatures on major business transactions...

Well, my experience with certain financial transactions is it requires a signature guarantee, usually from a bank. Notary isn't good enough. Having had to get both, I'd say a signature guarantee is more secure. Of course, with a signature guarantee, the bank can be held financially liable, so it only figures they would be more careful.

They Used To...

[the0ther]

YOu know they used to HANG horse-thieves. How about we bring that back?

Re:They Used To...

[Anonymous Coward]

That works too. Everyone write congress and bring back public hangings! Think of the marketing opportunities as well. We could sell stuffed nooses, trading cards of people who were hanged, setup beer n hotdog stands, etc. We would have to spend less on prisons, and Uncle Sam earns money from sales tax. Plus, the victims get the satisfaction of watching the person who ripped them off get what they deserve. (can ya tell I've been screwed over before by a con artist? :-/ )

Maybe its a good time to get a BOA account now

[Marrow]

They will be apeshit over security for a while...

Have you been sold?

[Anonymous Coward]

To see if your account has been compromised, please visit youraccount.ru/free_report.html.asp and type in your name and account number.

Austria...

[the_archer666]

I heard, that in Austria, phonebooks have a 'bogus record' inside them. Well, maybe banks should create such bogus records an give them to Choicepoint and Co. to at least find out where such leaks are? Kind of 'Honeypot account project'.

If your bank notified you, would you notice?

[DunbarTheInept]

Allegedly the affected customers have been notified by their banks. This leads to a question I have - with phishing being so common, when anyone receieves an e-mail from their bank, do they believe it's really from their bank anymore? Especially when it says it's about an alleged comprimise of their account?

One of the wost things about spammers is that they generate a "boy who cried wolf" problem for people sending legitimate e-mails.

Re:If your bank notified you, would you notice?

[LibertarianWackJob]

You are absolutly right. I would expect that the banks are notifying customers via regular mail. I've always heard that a real bank will never communicate somthing like that via e-mail.

better yet...

[slew]

In criminal law, if the police acquire certain evidence illegally (e.g. w/o a search warrent), then that evidence and anything that follows from that evidence can't be used in a court case against them.

If we extended this principle to debt collection and say if the collection agencies did something illegal in the process of collecting a debt, then the debt (or at least some part of it) would be void, wouldn't that be something to think about...

Nah, that would be too easy... ;^)

Re:What will it take?

[underwhelm]

I'm not sure what you're talking about here, so I can't really respond to you. The only major battle I know of in the Senate is over appelate court nominations, and I haven't read anything yet about changes to how nominations are handled.

Then you're not paying attention. Don't bother responding, though, I suspect your opinion will be ill-informed.

Bad credit? No problem

[whoppers]

My credit sucks, so if anyone is dumb enough to steal mine, they'll end up wasting their time.

Mwahaha

Re:What will it take?

[jea6]

Don't bother responding, though, I suspect your opinion will be ill-informed.

This has all the markings of a great sig.

Re:What about the agencies? Will they face charges

[Anonymous Coward]

You didn't read the article, did you? Of course not - otherwise you wouldn't have posted a stupid comment.

Personal Information Theft

[Anonymous Coward]

Here is perfectly good example of why RealID (tm) is a bad idea. Security is only as good as the people behind it. In case you don't know what RealID is, you'll know soon enough. It passed as part of an emergency war-funding bill. Your driver's license will be the new national ID card. Enjoy. Posting as an AC, because I'm just afraid of my ID being stolen.

Did they promise unbreachable security?

[glrotate]

No, nor did they promise the bank president wouldn't take all of my money to buy coke, hookers, and a ticket to Fiji.

In the law there are such things as due dilligence, and negligence. Some of these organizations need to get hit with a massive lawsuit in order for the message to be sent loud and clear.

Re:Did they promise unbreachable security?

[Anonymous Coward]

No, nor did they promise the bank president wouldn't take all of my money to buy coke, hookers, and a ticket to Fiji.

Generally, they do promise that your money will be there when you come to ask for it.

Re:Did they promise unbreachable security?

[Anonymous Luddite]

>> Generally, they do promise that your money will be there when you come to ask for it.

The last two accounts I opened had buried in the small print that the bank could hold my cash for 30-60 days AFTER I ask for it.

I doubt very much this happens often, but it does happen - I have family who lost a house deal over a wire transfer held for 60 days.. Cash in the bank, earned free and clear, but held nonetheless. If one of the Banks decides to fuck you over, you'll stand a better chance negotiating with Vinnie...

Re:Did they promise unbreachable security?

[Tassach]

I have family who lost a house deal over a wire transfer held for 60 days.. Cash in the bank, earned free and clear, but held nonetheless

I almost lost my house in a similar incident. The broker I was using at the time had a policy that it took 7 days to issue a check. So, about 10 days before closing I put in a request for them to cut me a check for the amount I needed for closing. 7 days later, no check. Call them the next morning (2 days before closing) and they give me some bullshit excuse as to why they didn't cut the check, so I immediately close the account, which of course they won't give me my money for ANOTHER 7 days, which would have done me no good at all.

Fortunately I was able to borrow the money from my family to pay the closing costs, and then pay them back 4 days later when the broker finally gave me my money. I didn't get everything arranged until a few hours before closing.

Re:It's not perfect, it can be made more difficult

[kabocox]

The reason we don't have systems like that is because there isn't any financial incentive to implement them.

When it costs them several hundred million in federal fines, then they will fix the problem.

Re:It's not perfect, it can be made more difficult

[Anonymous Coward]

Somewhere, somebody has to have the root password.

Now matter how secure you build your system, you are still trusting the root user.

Don't bother responding, though...

[glrotate]

The filibuster has nothing to do with the nominating process. The filibuster is not in the constitution. It is simply a gentleman's agreement in the Senate. When one party abuses such an agreement, they should expect it to be abandoned.

Re:Don't bother responding, though...

[Anonymous Coward]

he filibuster has nothing to do with the nominating process. The filibuster is not in the constitution.

There's nothing in the Constitution requiring the Senate to vote on a nominee either.

It is simply a gentleman's agreement in the Senate. When one party abuses such an agreement, they should expect it to be abandoned.

*One* party?? You don't know your history. Some of those same judicial posts are ones that Republicans filibustered (and were never filled) when Clinton was President. Both parties filibuster to block nominations. Only the Republicans seem bent on changing the rules to suit themselves.

Re:Don't bother responding, though...

[Maxwell'sSilverLART]

There's nothing in the Constitution requiring the Senate to vote on a nominee either.

Article II, Section 2:

[The President] ... shall nominate, and by and with the Advice and Consent of the Senate, shall appoint Ambassadors, other public Ministers and Consuls, Judges of the supreme Court, and all other Officers of the United States, whose Appointments are not herein otherwise provided for, and which shall be established by Law: but the Congress may by Law vest the Appointment of such inferior Officers, as they think proper, in the President alone, in the Courts of Law, or in the Heads of Departments.

By any rational reading of that passage, the only appointees that don't need Senate confirmation are those that Congress has exempted from Senatorial review. Since they haven't done so for judges, the Senate is required to consider the President's appointments. The Constitution does not specify a means for consideration and approval, just that it happen. The Senate has chosen to adopt a vote of the members as its means of consideration. Certain Democrats' threat to filibuster (and they haven't filibustered yet) thwarts Senate Republicans' efforts to consider the nominees, either approving or rejecting them. So, while the Senate isn't explicitly required to vote on nominees, the duty to give consideration is clear.

Note that I also disagree with the plan to reduce the threshold for invoking cloture; I think both parties are acting like spoiled children. If I had my way, the Republicans would show some stones, force the Democrats to actually filibuster, we'd all get to see how stupid both parties are being, get fed up, and beat all of our elected representatives with Giant Foam Cluebats.

Fat chance of that happening.

Re:Don't bother responding, though...

[Anonymous Coward]

Article II, Section 2:

[The President] ... shall nominate, and by and with the Advice and Consent of the Senate, shall appoint Ambassadors, other public Ministers and Consuls, Judges of the supreme Court, and all other Officers of the United States, whose Appointments are not herein otherwise provided for, and which shall be established by Law: but the Congress may by Law vest the Appointment of such inferior Officers, as they think proper, in the President alone, in the Courts of Law, or in the Heads of Departments.

By any rational reading of that passage, the only appointees that don't need Senate confirmation are those that Congress has exempted from Senatorial review.

Uh. I said "vote." I'll repeat it again. There's nothing in the Constitution that requires a vote. The Senate need not vote to not give a confirmation. Think of it as abstaining.

Now, there are different ways to abstain. The nominee can be filibustered, or the nominee's advancement can die in a committee. Both ways deny the full Senate an opportunity to vote.

Your "rational" reading of the Constitution is highly suspect. Spin it all you want, but show me the word "vote" in that paragraph.

Re:It's not perfect, it can be made more difficult

[prisoner-of-enigma]

The reason we don't have this is because, in the USA, the crooks are writing our laws.

As opposed to the rest of the world, where the laws are written by crooks in Parliament, juntas, dictatorships, and caliphates. Don't think the U.S. has a monopoly on crooked politicians. In fact, the term "crooked politician" is effectively redundant all by itself, just like "crooked lawyer."

Credit Unions are becoming targets too...

[taped2thedesk]

Ironically, I got this e-mail from the University of Michigan Credit Union a few hours ago:

This notification has been sent to all members of the U-M community to inform you about an e-mail phishing scam that looks like it has been sent to you from the University of Michigan Credit Union. THE E-MAIL IS A FRAUD AND SHOULD BE DELETED IMMEDIATELY.

Although the e-mail message may look official, its real purpose is to collect personal information that can be used illegally. The University of Michigan Credit Union did not send the e-mail message and would NEVER ask its members to confirm identity or personal information by e-mail. If you receive the e-mail message, please do not respond to it, or provide personal information on the fraudulent Web site as the message requests.

If you have already provided the personal information requested in the message, you should CONTACT THE UM CREDIT UNION IMMEDIATELY BY PHONE and speak with a Member Service Representative at 734-662-8200 or Alan Augustine at 734-662-8200 ext. 2651.

Some people at U-M have been victimized by similar scams and have had money withdrawn from their bank accounts. If you are a victim of fraud because of a phishing scan, you should work directly with your financial institution and the police to resolve the situation.

Financial institutions do NOT request personal information, such as your social security number, account number, or personal identification number by e-mails that require you to follow a link to another site. Please do not respond to such e-mail requests, or click a link embedded in an e-mail to provide personal information. You could put your account at risk, or the phishers could open new accounts with your identity.

TIPS ABOUT PHISHING SCAMS
You can sometimes tell that an e-mail is a phishing scam because it will contain many errors. For instance, the message supposedly sent by the UM Credit Union has the following errors:
1. The "reply link" says it goes to umcu.com. The true Web address for the credit union is umcu.org. If you go directly to umcu.com, you find a screen that says "this domain name for sale."
2. The Web site says the "bank" is a member of the FDIC. This is not accurate because credit unions are insured by the NCUA.
3. The e-mail contains misspelled words. The last word of the message is spelled wrong "to fallow."

[...]

Thank you.

[Name Deleted], CISSP
Chief Information Technology Security Officer
University of Michigan

Screwed

[lullabud]

No shit. I'm sure it doesn't help now that the damage has already been done, but I finally closed my BofA account. I was a Fleet customer who was dragged through the mud during their merger, and after being on the fence about closing my account this definitely shoved me off.

hmmmm....

[Impr3ssion]

Good thing I don't have any money!

Normally Windows, but Solaris is 3 here.

[WindBourne]

Normally, the break ins involve Windows (in fact, Windows has some 40% of https space, Yet, has more than 95 % fo the thefts). But here windows is only 1 out of the 4. Solaris accounts for the other 3.

That assumes that they really are on the these sites. With the big break-in that occured with Visa/MC/Discover about 1-2 years ago, it took awhile, but they found a Nebraska clearing house running windows had been broken into, not the CC sites.

Re:Normally Windows, but Solaris is 3 here.

[Motherfucking Shit]

Normally, the break ins involve Windows (in fact, Windows has some 40% of https space, Yet, has more than 95 % fo the thefts). But here windows is only 1 out of the 4. Solaris accounts for the other 3.

There were no "break ins" involved in this incident. Employees at Bank of America and Wachovia were looking up customer records and selling them at $10 a pop. The guy they sold the information to turned around and re-sold it to collection agencies and law offices. Basically this is a case of social engineering done by some wanna-be private investigator.

Computers weren't the weak link and no OS is at fault.

Re:Normally Windows, but Solaris is 3 here.

[Legion303]

Yeah, but I bet the employees who illegally sold the info were using Windows on their work computers. OMGconspiracy!

Re:It's not perfect, it can be made more difficult

[ArghBlarg]

Have you ever considered blowing the whistle on their lax security? Really -- contact some media outlets, try to contact large stockholders etc. It's the best thing you could do for the people whose data is held there. You'd be doing a service to society at large.

Re:It's not perfect, it can be made more difficult

[WoTG]

It's too bad that whistle-blower protection laws are still a joke in Canada. They were in the US too, until recently (i.e. Enron).

Re:What will it take?

[Anonymous Coward]

this seriously violates the principles of federalism

Yeah, because the party that currently controls the three branches of the US government is super-duper concerned with federalism.

May it please the court :

1. Medical marijuana in California
2. Euthanasia in Oregon

Both voter approved initiatives. Both under attack by that bastion of Federalism, the 21st century GOP nanny-state. This is just a small, off the cuff sampling of Bush & Friends egregious usurpation, er, attention to the rights of states.

HIPAA isn't "squishy"

[ubernostrum]

HIPAA definitely has teeth, and there have already been successful civil and criminal prosecutions for violations. I'm not sure what you mean about the lack of an "enforcement mechanism"; if your protected health information is illegally disclosed (damages or no damages), you have the right to bring suit against the person or persons responsible. Depending on the violation, there may also be applicable federal criminal charges. None of that requires the designation of special "enforcement mechanisms" aside from the existing federal court infrastructure.

And HIPAA does not, AFAIK, require you to periodically show compliance; federal officials can spot audit you if you work with PHI, but there are no regular reports or paperwork to be sent in (of which I'm aware; when I worked in health insurance I had a lot of dealings with our HIPAA people, but of a different sort).

Re:HIPAA isn't "squishy"

[Mr. No Skills]

My "enforcement mechanism" comment reflects that there are no federal auditors for HIPAA compliance, unlike banking regulations. The government is not pro-active (yet) in enforcing this, as citizens have to discover the problem then bring suit. The punishment is well written (and strong), but its not like there's a HIPAA cop on the street enforcing the law.

I'm sure that someone who sues is glad at least the requirement for compliance is there, but most organizations have been sluggish in their understanding and adoption of the regulations.

Re:HIPAA isn't "squishy"

[ubernostrum]

but most organizations have been sluggish in their understanding and adoption of the regulations.

I can only speak to my experience in the field, which involved working at a health-insurance company. I was given pretty thorough HIPAA training when I was first hired, and then updated training as different bits of it took effect for us. We were instructed to always err on the side of caution with HIPAA, and in situations where it was uncertain how to proceed we could refer back to people whose full-time job was to know and interpret HIPAA.

Re:What will it take?

[DavidTC]

seek out groups of marginally damaged people and organize them for a suit

I don't know anything about this, but I have to point out the entire point of class action lawsuits is for groups of 'marginally damaged people' to come together and sue a company that insists on continuing to damage people in small ways.

If the company harmed them in large ways, they'd just sue individually! But no one's going to sue the phone company for their continual theft of two dollars a month or whatever.

Solution: A class action suit, where a large group of people can get together and sue for several hundred thousand.

Now, I'll be the first to admit that the amount lawyers get out of class action suits is absurd, and maybe Federal jurisdiction is the solution. But the fact you think it's somehow bad that, recently, large groups of slightly harmed people have started suing companies shows you don't know that's exactly what class action suits are for.

easy on the tinfoil

[PenchantToLurk]

1) The FBI is in both cases investigating those with intent to break the law. That includes the fraud, the insiders, and the kiddies. The bank did not have intent here, and (legal guessing mode on) can only by tried in a civil court for negligence.

2) Sort of agree with you here. People want to remain detatched from the responsibility of mantaining their liberty and security so they may erronously place the entire blame others. I keep in touch with my congressman, as well as exercise my right to keep and bear arms.

3) You gave Wachovia your money willingly. And like any contractual relationship with a business, they can bill you for whatever they please. You don't have to agree, and can dispute the charge as well as its addition to your credit report. I wouldn't bet the contract you willingly signed with Wachovia affords you much success here, however.

4) Nope, it'll be all over the news, as its something bad for the sheeple to be afraid of.

Re:easy on the tinfoil

[Vitriol Angst]

PenchantToLurk. You sound reasonable, but you are a moron among many. You are the sheeple you make fun of.

OK, I'm going to generalize, but anyone can find a thousand examples of what I'm talking about--I can get them if I thought it would change any minds;
Social Contract & Capitalism 101; The government should be involved in what companies can put into contracts. Every business attempts to remove all rights from people with these contracts. Most people don't have lawyers on hand to read and dispute these things. There are no banks without contracts that allow them to arbitrarily do whatever they want and not be held accountable (except for the $100k account insurance).

You are living in a fantasy world where capitolism is America actually provides "CHOICE". That has been gone for a while now, since the Government gave up it's duty to regulate and control monopoly abuse.

In the real world, people don't have the time to dispute each and every contract, and they must pay bills, taxes, get to day care or a 1,000 other things that keep us insanely busy. We have food quality protect by the FDA so that people don't have to sue AFTER they lose a loved one to botullism. We have the EPA so that a class action lawsuit (which has a slim chance to actually compensate anyone) can be conducted years after birth defects and cancer are found (and torte reform is pretty much ending this). We used to have some protection.

There is this dillusional absolute theory of free market and choice that never, ever existed. It results in people who just suck up to anyone in power with the words; "you had a choice". Hey, there is no more Santa Claus, and people have choice only when they have the time and energy to fight. But how can I fight the landlord, the bank, the insurance company, the grocery store, the school that serves pizzas and has no PE? How do I fight the phone company that doesn't allow me DSL without paying for services I don't want? How do I fight the government that is stealing my childrens future?

You sound reasonable, because everyone has become clueless and insanity is the norm.

4) It will be all over the news.
Like that will have any effect. You seem to confuse the insipid sock puppet shouting that goes on CNN and Fox for journalism. After the noise then more noise about something else. There will be nothing done. Did you know they found $3 Trillion in T-Bills recently? Sounds like an important topic. Suprising that wasn't on the news. The news in this country is total crap, and you think its liberal... because it tells you so. Wow.

The Libertarian/Republican thought is just a club to make people think they are smart by agreeing with eachother. At least the Dems and Progressives know there is something wrong. We keep shouting it to you people, but you think we are saying; "hey, we are whining about things not being more Liberal!". No, we are upset that things are wrong. I am a results oriented person. Do you see any good results from all this corporate profiteering and lack of accountability?

Please don't whine when your child gets Athsma, or your pension is robbed so that executives can have million $ golden parachutes. Remember, it was your choice.

Re:easy on the tinfoil

[PenchantToLurk]

Oh please. This will be the last post I make on this, as this will not continue to be a productive dialogue. Your 'liberty is a LIE perpretrated by the MAN' sounds like a ridiculous cartoon.

I won't disagree that the system isn't fair. I won't disagree at all that the large and powerful institutions hold unfair sway.

That said, I simply don't believe that there's an all-seeing, all-powerful secret elite club that coordinates as effectively as you insinuate. It's more likely your 'elite crew' is sitting around bitching about how democrats, unions, and consumer groups are conspiring to destroy capitalism, and take away their right to do business.

Re:easy on the tinfoil

[Vitriol Angst]

See, nobody has to actually talk about the issues anymore, because they are trained to respond like Pavlov's dog to certain words. I talk about large corporate and political abuse, and I am a hippy complaining about "the man". I talk about problems with our contries Tyranny, and I'm anti-American. I talk about issues like ownership being favored over labor and I'm a Socialist. You don't even have to listen to what is said--you already know what to say. And if I point out that you are wrong--quick answer--"oh, you are one of THEM". Whatever THEM is, currently. You will really disappoint me if you start saying that those who criticize capitalism are communists or those who criticize America are Anti-American. To keep this system and country great, you must check the inherent weaknesses to the system. It has been reduced to a Pavlovian Response. Just like saying; "Knee Jerk Liberal". Some people actually do respond automatically--both sides are guilty.

Of course, I don't expect any response, I'm talking to people who "get it". But I don't have the time or ink to rehash and spell it out. So I'll give someone a brief overview of "THE REAL WORLD".

I used to think like you do, that you shouldn't assign to conspiracy that which can easily be explained by stupidity. Democrats, unions, and consumer groups don't have the money or power to do much of anything anymore. They are a dead horse that the Corporate media likes to pound every now and then to pretend there is an adversary to capitalism.

The REAL way the world works can be described in Confessions of an Economic Hitman by John Perkins . It is part of the infrastructure and has been for almost 200 years. It represents Trillions of dollars (mostly offshore) and is the major reason for the economic power of the United States. Look, I have been a Dem, an Independent, a Republican and a Ross Perot Libertarian. I'm hoping the Progressives are at least as useful as a floating piece of wood but their current silence and cowardess makes me despair.

The corporate media wastes air time on straw issues like welfare, where we spend less than a tenth of the money that the Pentagon admits to losing. You could fund all our social programs with what we lost in the S&L crisis--so how is regulation NOT a fiscally conservative issue? Do the math.

GM, Unicol, Bechtel, Haliburton, et alas (not a comprehensive list) are always spending money on politicians and are first at the trough when the US has a war, or the US repairs a country, or the World Bank gives a loan. See, the way the world really works is that "consultants" wine and dine a third-world leader. They promise riches and support for power in whichever country... let's say Panama. So, the current leader ends up, more or less dead, Noriega gets money to fund his push for power. World Bank now gives Panama mucho dinero for development. Since Noriega has a nice sweet heart deal with the "consultants", he returns the favor and sends troops to whatever "freedom fight" or weeny roast we have at the time. And he also makes sure that all the money ends up going to one of the multinationals in the trust. Flash forward a few years and you find, that with rare exception, another country is bankrupt because all of that World Bank loan went to a US Multinationals that did nothing for the country, and didn't make much of a positive economic impact. But the dictator is still in power and wealthy, but usually his people go hungry. When you have an exception, you get military intervention. Noriega didn't send his drugs through the correct channels. Saddam didn't follow James Baker's plan to give all his countries wealth to Kuwait. And Bin Laden wouldn't let UNICAL put a gas pipeline through Afghanistan without some compensation to the people. I'm not saying these guys are sweethearts--remember, we put every one of them in power (Shah of Iran and Batista in Cuba as other examples). But, like Chaves in Venezuela (with more than a dozen assassination attempts), the difference between a live Tyrant and a dead

no problem

[Anonymous Coward]

since customers are notified, all they have to do is now change their names, ages, and addresses to regain their privacy...

thank you america, where this is all possible!

Please

[uchi]

Thank god I'm dirt poor. Please, I am almost begging someone to steal my identity/debts.

There is an advantage of having bad credit!

[thomasa]

If someone tried to use my identity to get a credit card or a bank account they would be laughed out of the bank.

Deliberate misnomer this 'identity theft'.

[Senor_Programmer]

It's plain old fraud and the onus should be on the merchants and lenders who fail to verify the identity of the person they are extending credit to.

But no, this is too costly, so they try to put it back on the person who's information is used in the fraud.

It's NOT RIGHT! If someone else borrows money in your name, it's the lenders problem, not yours. Your identity was not stolen. You are still you. The lender is at fault because he failed to exercise due diligence in a climate where fraud is rampant.

Just think about it for a minute. You are NOT the victim of identity theft. You are still you and the other guy screwed some third party. Why should it cost you any money or any time... Instead, the idiots who carelessly or out of greed failed to verify that it was indeed you and not someone else requesting a credit report and credit should pay.

There's a simple solution too.

The credit reporting companies need to stop selling information to anyone other than the person who owns the information. Mainly you if it's your information. You want a loan, you request the information. Hell, if it takes a photo ID and a visit with a rep from the reporting company, then that's what it takes... But it's their problem to solve, NOT yours.

Re:Deliberate misnomer this 'identity theft'.

[Legion303]

Did you read the article? Did the idiots who modded you up read it? Allow me to quote from it:

"the department has not yet classified this as an identity theft case but is watching it closely."

Re:Deliberate misnomer this 'identity theft'.

[Anonymous Coward]

yes, i read the article

i am not referring to the specific case

it's the general use of the term 'identity theft'

WRT this specific case there should be no option of calling what happened 'identity theft'.

there is NO SUCH THING, other than as a brilliant CYA spin put on irresponsibility, greed, and carelessness of credit industry...

Re:It's not perfect, it can be made more difficult

[Anonymous Coward]

Posting details of an insecure system to slashdot? I'd say the whistle has been blown.

You make them delete it

[Sycraft-fu]

When the secret service walks in and gives you a choice of destroying all the data, proving you did so, and signing a sworn statement under the penalty of perjury that you did so, or being thrown in jail, odds are you do as they tell you.

I know that when something like this happens much of /. wants due process thrown out the window and the people put away immediatly, but if you spend the time to follow the case, I bet you find that's just what will happen. You'll notice those that actually did the stealing are already arrested pending trail, they have said the next phase is going after those who purchased the information. I'm betting arrests are made and charges leveled in some cases, and fines plus removal of teh data in all cases.

However if you want to know, you'll need to be patient and do your research. The legal process is slow, and something like this could take well over a year.

Greater Depression

[Doc Ruby]

The era of cavalier stock market margin (debt) buying abuse crashed in 1929, taking the world economy down the tubes with it. If identity theft repeats history, the crash will be even harder, falling from a greater height. Congress didn't really reform banking until 1934, when the industry was reregulated. It would probably take at least as long for new laws again, with the more corporate Congress less likely to regulate anything. And even those 1934 laws were mostly thrown out in the late 1990s, in deference to Citigroup's remerger of "integrated financial services", previously protected by "firewalls" of nonownership across banking, insurance and brokerages. When they blow it this time, a mere decade of Depression might look like a little hangover.

Re:What will it take?

[stlhawkeye]

Then you're not paying attention [google.com]. Don't bother responding, though, I suspect your opinion will be ill-informed.

Ah! Yes, the filibuster. I'll summarize this the best that I can.

The President is nominating judges for various vacancies in our various court systems. Some/many of them are considered by the minority party to be too extreme and thus unqualified for the offices to which they are being appointed. The names of these judges have been enumerated by the Democrats, and they have threatened to filibuster the nominations if they leave committee.

The Republicans have responded to this by threatening to change the senate rules regarding the filibuster of judicial nominations unless the Democrats allow a floor vote on the Senate on these judges. I'm unsure if they wish to disallow the filibustering of judges entirely or change the number of votes required for cloture.

Democrats responded to that by claiming that Republicans are threatening to break with Senate tradition, and frequently cite that Bush has had a very high percentage of nominations approved.

Republicans respond by claiming that it's the Democrats who are breaking tradition by filibustering judges, which has never been done, and that the approval rating quoted by Democrats for Bush is misleading because they're ignoring appelate court nominations.

The Democrats counter that Republicans blocked Clinton's nominations. The Republicans counter that they just voted them down or didn't allow them out of committee, which is somehow different from filibustering.

So basically, everybody is pointing fingers at what a douchebag the guys on the other side are and how nobody is getting their way so the other side is just a bunch of big meany doodie heads.

I have not observed, in any of this political onanism in the Senate, a genuine threat to our system of checks and balances. Judges require a majority of the Senate to approve the nomination. If they go to a floor vote (i.e., the Republicans change the rules to break the filibuster without cloture), they will still need a majority of votes for the nomination to become a nominee. It's possible that the Republicans could trigger this "nuclear option" and still not get the appointments made. I do not, therefor, see a threat to checks and balances. I see a part that held power in the legislature for forty years acting like children because they're not getting their way anymore, and I see the party that has recently come into power having no clue how to conduct business as the majority, or how to engage in the least bit of diplomacy or debate.

If you wish to label my opinion as "ill-informed" simply because I don't agree with you, feel free. The smug intellectual superiority in that comment is sufficient for me to conclude that you're not really interesting in discussing or debating anything either. Most likely, you're a well-intentioned liberal who is angry first at the Republicans for the various atrocities of public policy they have visited (or are threatening to visit) upon our society, and secondly you're angry at the sheer incompetance of the Democrats, their inability to win elections, and the utter vacuum in that party of any leadership, intellectualism, ideas, or the semblance of a platform.

So don't worry. You're angry at your dad, basically, not me. I won't take it personally.

Re:It's not perfect, it can be made more difficult

[STrinity]

The reason we don't have this is because, in the USA, the crooks are writing our laws.

1. Create a script for posting random, populist, anti-government platitudes on Slashdot.
2. Run script through several accounts.
3. Once accounts are karma-fortified, auction them on eBay to trolls.
4. Profit!

Wells Fargo has BOA beat by a mile!

[funk49]

Wells Fargo has *THE* worst security of all the large financial institutions.

Last year, I received a notice that my personal info was on a system of theirs that was compromised. I called the customer support number given and inquired about what happened. Turns out, a laptop at a billing facility (yeah, i know...a laptop) was stolen along with a few others in a physical security breach.

On that laptop was the personal info (SS numbers, addys, everything) of 300,000 account holders. Yes, that's right...300,000! Worse part is that this same scenario has occurred 3 times in the last 2 years!

Wells Fargo's CSO and CISO should be flipping friggin' burgers instead of providing security as they are
setting the standard for how bad you really can be.

Hey Wells Fargo asshats, ever heard of getting some kind of policy and compliance audits going?

Re:What will it take?

[stlhawkeye]

I don't know anything about this, but I have to point out the entire point of class action lawsuits is for groups of 'marginally damaged people' to come together and sue a company that insists on continuing to damage people in small ways.

That's not strictly true. A class-action lawsuit is, at its most basic, a lawsuit filed on behalf of a large number of injured parties who share a common complaint, generally with a common defendant. The group of injured individuals doesn't necessarily need to be identified individually for the lawsuit to be filed on their behalf. I can benefit from a class action lawsuit without having ever even known it took place, because a group of people went forward on behalf of all injured parties, with or without their consent. The severity of the injury is irrelevent.

And, in truth, it's also irrelevent in my post. The plaintiffs could be marginally damaged or severely, it's not really the point. The point is that where groups of commonly-injured plaintiffs would at one time self-organize and hire counsel, now the counsel finds injuries and solicits for lawsuits. The system had been previously organized such that counsel could cherry-pick soft targets in the state courts that would award massive and (sometimes) disproportionate damages. Counsel would often chew through an alarmingly high percentage of that, leaving the truely damaged parties with little or nothing (and sometimes in the hole!) while the true award went to counsel.

The changes to the class action lawsuit system were intended to mitigate this problem in the case of large suits that involve multistate plaintiffs. The issue is then given original jurisdiction in the federal district courts. Note that counsel can still move for a change of venue, and, as far as I know, get the case moved back to the state, whereas before it was almost impossible to do the opposite.

This could result in, say 15,000 injured parties in California being represented in New Mexico state courts over something that happened in Colorado, because the attorneys hand-picked a generous and sympathetic court that they felt was likely to decide in their favor and decide big. And we all know that the courts can be effective legislative instruments. There has never been any legislation passed to specifically allow or ban abortion, and yet it's unquestionably legal; not through an act of Congress, but through the court system.

Maybe that's more clear, I don't know. :)

But the fact you think it's somehow bad that, recently, large groups of slightly harmed people have started suing companies shows you don't know that's exactly what class action suits are for.

I don't think that's bad, and I never said or implied I did, you read that from my post due to your own bias as a reader. I did not pass any kind of judgment on the idea of the class action lawsuit. I also further submit that you don't truly understand the purpose of the class action lawsuit. It is not to benefit marginally damaged people. That's what small claims courts are far (and they're structure to discourage legal action for minor damaged, instead encouraging citizens to work it out on their own as far as possible). It's so that a large (and often unidentified) body of injured parties who share a common injury/interest/agenda can be represented by a sample of plaintiffs.

come together and sue a company that insists on continuing to damage people in small ways.

Also not true. The company need not still be causing damaged. In fact, it may have ceased causing any damage quite some time ago (I am unclear as to how statutes of limitations apply in class action cases). The company could still be found liable. McDonald's put HOT labels on their coffee, and they still lost the case with the elderly woman who scorched herself. The tobacco industry has been putting warning labels on cigarettes for ages and they still lost. Wrongdoing needn't be current and ongoing.

Consistency

[MikeMc]

Remember, it's not about losing 676,000 accounts - it's about losing 1 account, then repeating the process 675,999 times.

Re:It's not perfect, it can be made more difficult

[ergo98]

This is a hilarious treat to come across (God bless score:5 skimming). I actually worked at that organization for a short period of time. Sort of soul destroying, but it was an enjoyable stint.

While I can't confirm or deny the parent's claims (although I'm prone to believing their claims given the use of the term "machiavellian", which is one that I heard used by quite a few coworkers. It sort of lost its uniqueness), I will give the organization props by saying that there were efforts afoot to implement a secure infrastructure, so obviously at some point there were some changes. Perhaps the parent has outdated info.

Anyhoo, definitely enjoy how small of a world it is.

the Senate is required....

[glrotate]

No it isn't. The only requirement is their consent if the nominee is to be confirmed. Your reading something that isn't there. The Senate can, and has throughout the history of the republic, just take a pass. In such a case the consent of the senate hasn't been obtained and the nominee can't be appointed. It's their perogative.

Lame of banks

[Anonymous Coward]

Very lame of banks to sell personal data.
Banks are supposed to be professional and and very very concerned about their customers privacy and security!

What a shame...

Re:It's not perfect, it can be made more difficult

[kent_eh]

Of course you really have to work in a place like that to fully appreciate how terribly incompetent such organizations are

Actually, as a customer I get a pretty good sense of it too.

Re:What will it take?

[peachpuff]

"Second, they're moved to federal court not because federal courts are more business-friendly, but because of procedural differences in state court vs federal court. State courts tend to be more relaxed in due process procedures, and award ridiculous damages that are confiscated by private law firms."

No, the point was that laws and typical awards vary from state to state. It used to be that you could just pick a state: if a company does business in five states and screws people in all five of them, you could pick any one of the five. If one of the five is friendly to plaintiffs, you'd pick that one. That doesn't mean that all states are plaintiff-friendly.

You could say that the old way was unfair, but I think if you do business in a state you should be subject to its laws. It's certainly more fair than all these companies incorporated in Delaware, where they have no customers but lots of friendly courts.

Also, it makes no sense to claim that the President can't be responsible for a law. I don't know how hard he pushed this particular bill, but he's the most powerful person in the country and the leader of the majority party. His support makes a huge difference in whether a bill gets passed, as he or any member of Congress will tell you.

Re:It's not perfect, it can be made more difficult

[fishwaldo]

background: I work in a large asian Bank.

No one person has a root password, domain admin password or any privledged password. Its all under dual control, meaning the actual password is split in two, one half held by the security team, the other half in a safe thats only opened when the right forms are presented.

Use the root password? if your the second half password holder, you can't check out the password, so no one knows the root password.

Yay

[Sheepdot]

Just think how easy it'll be for theives to steal our identities when the national id card is implemented. And they said that social security numbers should never have been used to ID people.

Weird questions from the bank

[SamMichaels]

Maybe this is why Commerce asked me weird questions when I called for a balance. Usually it's address and SSN....this time she asked who was giving me direct deposits, the amounts, and the last few debit card transactions, places and amounts.

Screw The Story!

[Master of Transhuman]

Did you see the picture of Gerri Willis on the same page? Va-va-voom!

As an aside, as an ironic twist on BofA and "identify theft", when I was at my bank robbery sentencing hearing, the Presentence Investigation report said that BofA was unable to confirm I had ever been an employee there, either by name or by SSN, despite my having worked there for two and a quarter years. My attorney brought this up to the judge, saying we could supply former supervisor names, etc. The judge dismissed it as unimportant, saying "It makes you real confident about how they keep track of your money."

Gramm-Leach-Bliley Act

[Anonymous Coward]

The GLB Act was passed as US law that requires businesses that share and collect personal financial info to describe the nature of the sharing and what safeguards are used to protect the information. Just like any law, not everybody obeys it.

You can get more details at the Federal Trade Commission website: http://www.ftc.gov/

Re:Got fired for reporting insecure loan apps, try

[Anonymous Coward]

The secret of making this work is not to work for morons.

In my company (a big ass bank) they thank us for helping to keep them off of CNN.

that's why you haven't seen us on there (yet..)

Expected moderations from emotionally polluted /.

[Anonymous Coward]

My previous post is only considered "flamebait" because the typical readers of Slashdot who get mod points can only perceive things in an emotional sense and behave irrationally. The facts stand for themselves. Our society was built by people who have the drive and the ability to excel. Without that kind of drive, society would be a shambled, primitive mess. The people involved in this so-called "crime" visioneered an opportunity into a successful and very highly moral business. The percieved crime of "invasion of privacy" is simply an expression of sick emotion. There was no crime. If anything, the authorities bringing these charges against these upright citizens are the criminals. The real crime is that our society puts too much value on those who do little for society. Any other Objectivists with mod points, please correct the moderation so that a rational point of view gets more eyes. Atypical fro Slashdot to be sure, but required nonetheless.

All the way to the bank.

[Doc Ruby]

The people who stole this info were insiders, high-level employees of the bank. They committed the theft, they're responsible. The bank employed them, and was responsible for their actions. Just like if their security guards stole the money you deposited from a vault, before computers, they're responsible. Unless they found that the employees had breached the security protocols in some unpredictable way, not that the protocols were inadequate. Like relying purely on unaccountable trust of single employees without witnesses, as apparently in this case.

When we put our money in the bank, we reasonably expect they won't leave the door unlocked. When they do, or trust someone with a key, they are responsible. It's not each customer's responsibility to audit their security: that's what we have the Treasury, many other government organizations, and professional integrity to rely on. When a bank enables damages by allowing cracks in that security apparatus, they've got to pay the cost.

The irony -

[Anonymous Coward]

I had a temp job, once upon a time - preparing photocopies of documents, verifying they were the same as the originals, and binding them. Have to make bills somehow.
The irony was, that these were financial and operational control documents for a hospital group that was being sued for failure to exercise diligence in implementing their financial and operational controls - and here I was, making this month's car payment by riffling through customer and patient data that was supposed to be absolutely confidential and protected under HIPAA - but had been unceremoniously provided to a copy shop, and temp employees, neither of whom had any idea of what HIPAA was, nor had any training nor agreements to enforce it.
The very THING I was doing is the kind of thing they were being SUED for!

Something that hasn't been said before...

[artifex2004]

If your credit union isn't based in a state that has a law requiring disclosure, like California, you may not hear anything if your account security gets breached.
Most states have no requirement for notification, as far as I know.

fake ID

[KevMar]

So I should start creating a fake identity to open a bank account so that my personal information is safe?

Can we trust Banks anymore?

[Neelay H Thaker]

The incident is shocking, coming from a leading bank such as Bank of America. Its a classic case of social engineering. Phishing attacks are hard to prevent, since they are directed towards bank customers, with little or no information on banking security. However, attacks like these where the Bank employees are targeted need to be prevented. When a bank customer errs, he/she compromises his/her own information, but when bank employees err, they compromise thousands of identities, to say the least. Banks should conduct security workshops to educate employees, if they are not already doing so.

Re:It's not perfect, it can be made more difficult

[Anonymous Coward]

Exactly. If you look the advancement made in Anti Money Laundering software (AML) that allows banks to track customer transactions to a fine grain detail and raise flags as per variable rule sets, I am sure a similar software can be developed for taking care of customer information. Banks need to be more accountable.

FAR

[Anonymous Coward]

FUCKING ARMED REBELLION

Re:It's not perfect, it can be made more difficult

[Anonymous Coward]

In Soviet Russia laws create criminals but in America criminals create laws

Re:It's not perfect, it can be made more difficult

[Peeteriz]

In financial institutions, you have all the changes and transactions securely logged - but it's generally assumed that any phone-monkey is able to view all customer information, because how else they are supposed to answer customer enquiries ?
The same is for IT and accounting people - what they can do and change is very limited and logged, but they have full read access. Forget about privacy if it slows down workflow - this is business after all.

Re:It's not perfect, it can be made more difficult

[Anonymous Coward]

Of course you really have to work in a place like that to fully appreciate how terribly incompetent such organizations are, and to maek it more fun they churn their management around with no logic or thought. Remarkable stuff.

What do you expect from an industry uses imaginary money and then charges you for it? They don't have to do anything for the actual service, just the computers to keep up the illusion.

Well, I've seen the opposite

[CaptainZapp]

When I worked in FOREX software development for a Swiss bank from '87 - 90 I made a very different experience.

There was no way for any developer to get your hands on real customer data. You had to physically access the data center passing a couple of guarded security doors. Of course this would not happen unless you had proper authorization. You could not take any briefcase or even an envelope into the data center. It was absolutely verboten to take out even a scrap of paper and it's needless to say that a USB stick doesn't do you a lot of good with a Unisys 1100 and dumb terminals. The sytsems where completely isolated from the developer environment, which in itself was pretty well secured. Needless to say that every access was loged and provided strictly on a need to know basis.

There where also specific restrictions in the front office. For example: A normal teller could not look at accounts owned by bank employees without proper authorization from personel. PC's where never resold and the hard disks where shredded.

Yeah, it was a pretty restrictive environment and pissed us off on occasion. Searching through wades of data in a dark, cool and not very pleasent data center in a fortified building for hours on end isn't everybodies idea of fun. The difference with all that shit currently going on with US financial companies is probably that revealing bank customer data in Switzerland - intentional or not - is a criminal offense and the consequence is not just just the obligation to write a whoopsie, sorry letter, but actual jail time

Why identify theft is mis-applied

[Teancum]

I have some serious problems with the way that most financial institutions treat personal information. And particularly in the manner that they try to establish identity in the first place.

In most American financial instititions, all you need to know in order to access a bank account is just your name, with your social security number as the password. Anybody who has designed computer authentication and identification systems (confirming that the person signing onto a computer system/network really does belong there) should know that is really a stupid idea. Here is why:

Your Social Security number is really a part of your name. OK, it is a serialized number issued by the government guarenteed to be unique, but otherwise is public information. And considering the number of institutions that have that information (schools, banks, mortgage companies, utilities, credit reporting agencies, accountants, etc.) you can hardly expect it to stay private.

Imagine if you had a really cool password (like Blink187 as an example) that is long enough that a random alphanumeric generator would take a substantial amount of time to crack doing a brute force attack. Often people will use that same password to log into their accounts (like your user account here on /.) across multiple platforms. Face it, you can't remember 1000 passwords to access all of the accounts you need to get at.

This is the same as the SSN, however one critical thing becomes apparent. If you have been issued a SSN, it is nearly an act of Congress in order to get a new SSN number issued to you. Once somebody breaks the layer of trust (as in what happens by a banker that is careless with this supposed SSN password they use), you are forever in the cold. With your own homegrown password you can at least come up with a new password.

For my own use, I tend to have a heirarchy of about 3-5 passwords, with one for throwaway accounts that I could care less if the password gets published in a public place, and a couple reserved for machine logins that I consider very sensitive. I also am willing to drop a password completely from this heirarchy if I think I accidentally gave the information to somebody that I should not have (choose your own criteria here), or if I suspect the information is being shared against my will. I will go back and change the passwords in the accounts that I regularly access, and in some cases review the heirarchy. For financial information, however, this is usually not an option.

To further illustrate the ineptitude of banks, the only other piece of information that they use to "protect" your personal information (access your account, do money transfers, etc.) is the "PIN", or personal ID number. This is almost always a 4 digit number, and even then you can pretty much stick with just the numbers 1-9 for most of them. That gives only a little over 6500 different passwords, and you can do some social engineering to drop that number down a bit more. (like assume that no digit will repeat itself... reducing the number of possible PINs to about 3000). How hard would it be to brute force that many PINs? And this is considered a secure technology for a bank?

Banks want to make it easy for not-so-bright customers to be able to access their account, but at the same time make sure that only the person who opened the account (presumably... or a trusted representative of that person like a parent or lawyer) can access the information and more importantly... the money in that account. IMHO, banks and related organizations (like credit bureaus) are too fast and loose with that information, and make it far too easy for people who are not the account owner to be able to conduct financial transactions. (Like a scam artist that simply wants to drain any money you have in your account.)

Re:Bad credit? No problem

[Anonymous Coward]

They don't care what your credit is. There is always a bank that will open a credit line for you no matter what your credit is.

Your problem will just get worse.

Re:What will it take?

[stlhawkeye]

You could say that the old way was unfair, but I think if you do business in a state you should be subject to its laws.

Yes, you should and if I live in Missouri and am doing business with your company in Missouri, and I sue you, then the case is handled in Missouri barring a change of venue.

But if me and 50,000 other people from 9 different states sue your company, it's ridiculous to allow the attorneys to pick a plaintiff-friendly state to maximize damages, out of which they'll take the largest bite.

It's certainly more fair than all these companies incorporated in Delaware, where they have no customers but lots of friendly courts.

Companies incorporate in Delaware because the Chancery has written most of the nation's corporate law and is regarded by almost any legal expert on business and corporate law as an expert body on business matters. In short, yes, the state government is very friendly to businesses. Small businesses like to incorporate in Delaware due to relaxed personal information requirements (which we on Slashdot are always in favor of, remember? Personal privacy and information security is important!). The state doesn't tax revenue earned outside of its borders either, which is awful nice of them.

Why is this a problem in your eyes, and what would you to do fix it? Have the federal government step in and tell Delaware what its laws about incorporation will be? Why bother having states if that's the direction we're moving?

Also, it makes no sense to claim that the President can't be responsible for a law.

I agree. Good thing I didn't claim that.

I don't know how hard he pushed this particular bill, but he's the most powerful person in the country and the leader of the majority party.

I'm guessing he cut some deals. This particular president is legendary for lavishing rewards upon loyal party hacks.

His support makes a huge difference in whether a bill gets passed, as he or any member of Congress will tell you.

Yes, I'm sure he would. However, your primary grievance, if you dislike this legislation, is with these men, who wrote and sponsored the legislation.

• Charles Grassley (R. Iowa, Chairman, Senate Finance Committee)
• Herb Kohl (D. Wisconsin)
• Orrin Hatch (R. Utah)
• Tom Carpenter (R. Delaware)
• Arlen Specter (R. Pennsylvania)
• Zell Miller (D. Georgia)
• Lincoln Chafee (R. Rhode Island)
• Rich Lugar (R. Indiana)r

Once you're done with them, your beef is with the Senate and eventually the President who could have vetoed it and did not, and finally the courts for failing to see it the way you do.

Although the executive office is very powerful at this moment in history, there are other cogs in the wheel of government towards whom you should deservingly direct your ire.

Re:Hmm...

[MegaHyster]

Yes. 2000 Pro. But its locked up as tight as windows gets...

Re:It's not perfect, it can be made more difficult

[CrimsonAvenger]

The reason we don't have this is because, in the USA, the crooks are writing our laws.

I prefer Mark Twain's analysis:

Suppose you were an idiot. And suppose you were a member of Congress. But I repeat myself.

In other words, "do not attribute to malice that which can be explained by stupidity."

Number going up??

[ramsc]

Maybe my logic is bad, but if account info on 500k accounts was sold and some people had more than one account, it seems to me that the number of PEOPLE affected may go DOWN and not UP?? What am I missing??