Over Half a Million Bank Accounts Breached

Gone Phishing writes "CNN is reporting that about 676,000 bank accounts in at least four banks (Bank of America, Wachovia, Commerce Bancorp, and PNC Financial Services) have had personal information "illegally sold". Over 60,000 customers have been notified so far."

Comments

Stolen Account Information and Dupes

[ari_j]

Oftentimes, I'll complain about Slashdot dupes. Why can't this be one of those times?

Re:Stolen Account Information and Dupes

[NoTalentAssClown]

Great. So far this year I've received a letter from from LexisNexis and Choice Point. When my identity was stolen at the beginning of the year I thought "How could this happen? I have been so careful with my information." Apparently is doesn't matter how careful *I* am when everyone else just seems to be giving it away. Something has to be done to punish these people other than sending me a letter with how to PAY someone to watch my credit and alert me to "changes".

Re:Stolen Account Information and Dupes

[Anonymous Coward]

Since both a former employer of mine (SAIC), and a store that I made purchases at (DSW) have had recent losses of data, I am maintaining a fraud alert on my records at the credit bureaus. You can do this for free simply by calling any of the "big three" (Equifax, Experian or Trans Union) and requesting it. You only need to contact one of them, as the alert information will be forwarded to the other two. (It only lasts for 90 days, so you'll have to renew if you want it to continue.)

Re:Stolen Account Information and Dupes

[badasscat]

as for punishment, sure, that sounds good, but would be nearly impossible to implement in a fair manner as, in this case, lexisnexis was not responsible for the breach in any way, shape, or form. therefore to punish them for a breach not resulting from their actions would be unjust.

How about punishing them for their inactions? If somebody walked in to a military base and stole a nuclear warhead, would you throw up your hands and say "well, it wasn't the military's fault; they're not the ones who stole it"? Of course it's their freakin' fault! Who's supposed to be guarding this stuff??

Then of course, there's the issue of why they need to have this info in the first place. Just as you could argue if we didn't have nuclear weapons in the first place then there'd be no reason to worry about them being stolen, so you could argue that Lexis-Nexis - a company most of us have absolutely no contact with - should not have things like our social security numbers (which are for, you know, our individual social security payments, not anything else) to begin with.

If you are going to take it upon yourself to store my information, then you had damn well better safeguard it. And if you don't, then you should be held liable, and you should be punished severely when data is stolen through your negligence. (And in this case, I define negligence as "any case where your security was lax enough to allow data to be stolen" - or in other words, every single case of a security breach.)

If a company cannot secure this data to the point where it cannot be stolen, then they have no business holding this data to begin with.

Re:Stolen Account Information and Dupes

[Afrosheen]

So, you're saying it's unreasonable to trust the bank with your information and your money? Well, what's the point of having a bank account then? I know a guy named Vinnie down the street that'll loan me money and hold my money for me. The only difference here is that Vinnie won't leak information and won't lose my money.

Bank of Vinnie: Now 99% more secure than Bank of America.

Re:Stolen Account Information and Dupes

[Afrosheen]

"...so let get some money to gether and buy a congress person or two"

We'll let you be the spokesperson, you seem to have a strong grasp of the language.

Re:Stolen Account Information and Dupes

[Vitriol Angst]

I can't understand the "Group Think" that is going on. The same people who want to unleash the FBI on kiddies who download mp3's seem to never hold businesses accountable for anything.

We are so ripe for authoritarian rule. We want to leave control of our lives to others, and all we expect of security is to punish someone who doesn't cross every t and dot every i when they report on the failures.

The fact that Wachovia has my money and social security number and can demand many things of me without proof (such as fees and late charges), means that conversely, they should be responsible and compensate me for any damages resulting from their failure to live up to this trust. I think I need to pull my money out this week.

I thoroughly expect the news service to retract and fire anyone who reported this, but might have gotten the date wrong.

Re:Stolen Account Information and Dupes

[Ty]

Yeah that's all fine and good but you should know that Vinnie takes your dough and deposits in the bank down the street.

Re:Stolen Account Information and Dupes

[Karl Cocknozzle]

sensationalists who make it seem like banks just give this stuff away.

My beef is not with banks... They are generally pretty dilligent about customer data--they've been doing this stuff for a while now. MY beef (and I believe the parent poster's beef) is a company he has never done business with acquiring, storing, and failing to secure his personal information. Certainly, we should punish the identity thieves--and severely. But the reality is that, in the case of ChoicePoint, (whom the parent poster cited as contacting him,) they simply didn't have adequate protections in place to keep somebody from pretending to be a "legitimate" buyer of personal information. (We'll leave for another day the argument that there should be no such thing as a "legitimate" sale of my personal information by anyone but me. If Choicepoint wants to PAY ME to list my personal information for their own potential profit, that is another story, of course.)

Bottom line? If ChoicePoint wasn't in the super-sleazy, ethically dubious game of gathering and selling personal information, the data that was "accidentally sold" to these inappropriate persons would never have been divulged--because they never would have had it in the first place to be ABLE To divulge it.

Re:Stolen Account Information and Dupes

[Croaker]

that sounds good, but would be nearly impossible to implement in a fair manner as, in this case, lexisnexis was not responsible for the breach in any way, shape, or form. therefore to punish them for a breach not resulting from their actions would be unjust.

Um... have you thought this through? If what you believe were the law, then any company that has a legal issue, such as liability for security breach, illegal dumping of toxic waste, products that become sentient and wipe out humanity, etc. could get complete absolution if it got bought out by another company. "Oops! Sorry! You can't punish us! We got bought out be Totally Innocent Corp." And you can bet, a buyer can be made to appear at an opportune time, whether it be a real buyer or a shell company set up for the express purpose of ducking liability.

When Company A buys Company B, Company A should not only get the assets of that company, but it also take on the debts of that company and the responsibility under the law for any past actiona of that company. And I believe that's how it works under the law.

Re:Stolen Account Information and Dupes

[twstdroot]

Sadly, someone from the IT group would always be abl e to see that info. And this information was leaked by high ranking executives! What's broken here is the people who were so easily convinced to give the data up... not the banks.

Re:Stolen Account Information and Dupes

[Damvan]

"It is outlandish to expect a company to do any more for you than you have contracted with them."

But that is the whole point, we haven't contracted with any of these companies to do anything with our data. I never signed a contract with ChoicePoint, never even heard of them until this fiasco, but they still lost MY data. So I guess since I had no contract with them, they are not responsible for keeping that data secure? Then I want the ability to take MY data away from them if they are not going to protect it.

Re:Stolen Account Information and Dupes

[Foobar of Borg]

Actually, reading the article, it looks as though it was a bit of an inside job with Orazio Lembo paying off upper level bank employees. I think if everyone who banks at a bank that does a poor job of security simply takes their money out and goes with a different bank, perhaps a small, local one which often has better interest rates anyway, they would quickly change their practices. Sure, you would be giving up the convenience of tons of ATM locations. But compared with the inconvenience of having your idenity and bank account owned, I think having only a few available and free ATM locations is minor.

Re:Stolen Account Information and Dupes

[superpulpsicle]

Actual Bank Transcript... no joke.

Operator: Hi, your account has been on the fraud list and one of the transaction is under investigation.

Customer: What do you mean?

Operator: There has been a debit of $15000 in a transaction last night.

Customer: Have I been robbed?

Operator: Sort of. Because you did not purchase our Anti-Fraud plan, we will be working in recovering the stolen amount. But you will see a permanent debit of $60.

Customer: So I gain $15000 back, but lose $60?

Operator: yes

Customer: Great!

Re:Stolen Account Information and Dupes

[ColaMan]

What's keeping someone who knows you well from getting a credit card under your name?

I don't know about you, but in australia, it's called "100 points of ID"

From some random .au website:

Please note that your current licence/registration issued by this Office is not sufficient as proof of your identity. You will still need to produce documents that add up to 100 points or more.

Group A Each document is worth 70 points

* A fully certified birth certificate (or copy certified by a Justice of the Peace)
* A current passport
* An Australian citizenship certificate.

Group B Each document is worth 40 points

(preferably containing a photograph of the applicant)

* A current licence or permit issued under Australian law, eg. Driver's licence
* Identification issued by Government authorities eg. one of the following:
* Public Service employee identification
* Evidence of your entitlement to financial benefits or other entitlements from the Commonwealth or a State or Territory Government
* A student identification card issued by an Australian educational institution
* A statement from your employer or an acceptable referee verifying your identity and certifying that they have known you by your name for at least twelve months. (Preferably with a photograph of you signed by the employer or referee).

Group C Each document is worth 25 points

* Official correspondence addressed to you such as a public utility account (eg. gas, water, electricity), council rates, bank statement or similar
* Bankcard, Visa or other credit card
* Any other document which in the opinion of the person to whom it is produced, provides similar verification of the applicant's identity.

Re:Stolen Account Information and Dupes

[wdmr]

This is pure garbage. We *have* contracted banks to safeguard our personal information. Banks have a host of legal obligations regarding the safeguarding of personal information. And even if they didn't, their websites and agreements are full of statements like:

"Keeping financial and personal information about you secure and confidential is one of our most important responsibilities. Our systems are protected, so information remains secure." (Bank of America, Online Privacy and Security Policy)

I'm sure there are similar statements in the microprint contracts we all threw away the day after opening our checking account.

Heads *will* roll over this.

US data protection act?

[Colin Smith]

Isn't there a US equivalent of the Data Protection Act?

http://www.opsi.gov.uk/acts/acts1998/19980029.htmh ttp://www.opsi.gov.uk/acts/acts1998/19980029.htm

A few holes, especially principle eight, but overall it does what it's supposed to.

Re:US data protection act?

[jd]

Not exactly. In fact, so not exactly that Europe has repeatedly warned the US that it is technically illegal for European companies to trade personal data with the US, due to a total lack of any privacy law.

The closest the US has is the DCMA, which prohibits the reverse-engineering of encrypted data for the purpose of copying it, which essentially makes it a crime to steal encrypted personal data, but I've yet to hear of anyone actually prosecuted this way and it is extremely unlikely to ever happen.

Largely because commercial companies often don't encrypt personal data for customers.

Re:US data protection act?

[Daedala]

In a word, no.

We have several laws that apply to personal data. There are gaps you can drive a truck through, and the industry has spent decades doing just that. (I particularly like the part about how the laws specify that they only apply to "authorized uses" of personal data--so if it's not an authorized use, you can do anything. No, I'm not kidding.)

Re:US data protection act?

[neverkevin]

I don't know if the US government has any specific policies reguarding PPI and financial data, but the HHS has HIPAA http://www.hhs.gov/ocr/hipaa/ for personal medical data. The state of California has SB1386 to protect Californians personal financial data. However, neither go far enough and I am supprised more incidents are not made public. I suspect there are many more security breaches that companies are quiet.

Re:US data protection act?

[reallocate]

I don't know, but this could just as easily happened in the UK. Bank employees knowingly sold the data. The staff at your local Barclays could do the same thing, too.

Two points to remember: 1. No law (and there are laws against this in the U.S.) will prevent crime if the criminal believes he can get away with it; 2. The only techbical aspect of this crime is the way the data were stored. The same crime could have occured in 1905, except the info would have been passed in ledger books.

Re:US data protection act?

[jd]

It is, but any authored organized data is automatically copyright, which means that by creating a database entry with your name, address, SSN, ccard info, etc, in a structured and organized manner, where that structure and organization is preserved by the system, you have created a copyrighted work. Unless, by entering the data, you sign an EULA with the company that the data belongs to them. At which point, you're screwed but the company may be able to claim they have obtained the copyright from you.

Re:US data protection act?

[DogDude]

Exactly. It's in place. Everybody who has had data stolen should sue their banks. A bank that I just got a mortgage through sold my information, even though I explicity told them not to. Hence, I'm suing them. It's very simple, actually.

Re:US data protection act?

[arkanes]

This is not true. In fact, it is the opposite of true. Mere aggregation of data (like phone books, famously) are *not* copywritable. There is some wiggle room, especially if you have good lawyers - again famously, the annotations and numbers added by Lexis to court rulings are considered copyrightable, thus giving them a defacto control over large chunks of legal documents.

Because databases are not protected, many large personal-information companies have been pressuring Congress to pass special protection laws for them, but so far none have passed.

Re:US data protection act?

[Optic7]

How did you find out that they sold your information?

This could get ugly

[kcornia]

I'm sure the answer will be higher fees though, so in the long run the banks will be fine.

Re:This could get ugly

[ignorant_coward]

A while back banks like Wachovia tried to tighten down on their customers charging fees for seeing tellers, fees for ATM transactions, fees for deposits, fees for various forms, fees for breathing, etc. That didn't last long, so customers must have voted with their wallets. I know I rejoiced at being able to join credit unions at the time, because at least they don't treat their customers like an illness.

(off topic: what do blind slashdotters think of these new "confirm you're not a script" thingies?)

My account is safe.

[mrcrowbar]

Fortunately, my account should be safe. I got a email from Bank of America telling me about their problem, and I filled out their form to resecure my account. Such at great company to take care of their customers like that!

Re:My account is safe.

[shawn(at)fsu]

lol

The sad thing is this weekend I got two of those emails from differnt 'banks'. I wonder how many people fall for them. I actually tried to contact the real bank of the first email but their contact us page was impossible so there wasn't anything I could do.

Re:My account is safe.

[Spectre]

Um, are you sure it was the bank that contacted you? Sounds like a SPAM scam to me. . .

Are you by any chance damaged in the pre-frontal lobe?

Opting Out of 3rd Party Information Sharing

[Anonymous Coward]

Good thing i've opted out of having my bank share information with other parties. Opting out of information sharing is a wise thing for everyone to do.

Re:Opting Out of 3rd Party Information Sharing

[flynns]

I'm not quite sure you understand. It was ILLEGALLY sold. Without the permission of the account holder. Meaning that whatever you SAID you didn't sold...doesn't matter.

The bigger they are...

[__aaclcg7560]

This is why I switched to a local credit union a few years ago. Seems like the bigger the bank, the bigger the security breach. Worse... they nickel-and-dime you on everything else.

Re:The bigger they are...

[__aaclcg7560]

Why don't you check out my credit union before jumping to conclusion. Credit union ATMs are free, I usually buy my checks from an independent check printer, my checking account is free with direct deposit and they pay interest on the balance. Oh, yeah, since this credit union is located in Silicon Valley, they do have online access. :P

Re:The bigger they are...

[crow]

In Massachusetts, there are essentially two ATM networks, and you pay a fee if you use the wrong one.

There's the Bank Boston/Fleet/Bank of America network, and there's the SUM network that almost everyone else has joined.

In my case, my credit union doesn't charge fees for much of anything, and I can avoid ATM fees by avoiding the Bank of America ATMs.

Re:The bigger they are...

[utexaspunk]

Don't count on it. Credit Unions often outsource a lot of their operations to third-party groups to save on costs. Of course, the way the laws work, one doesn't often have to tell the customer that they are dealing with a third party.

I used to work for a collection agency that specifically did third-party collections for credit unions across the country. We just had an 800 number for each credit union, and we'd answer with the name of the CU depending on which line rang. Same with sending out letters- just change the letterhead accordingly.

If your CU is dealing with the kind of numbskulls I worked with, your data is probably just as insecure if not moreso than if it were with a big bank.

I've been using Washington Mutual for about a year now, and haven't been nickled-and-dimed on anything, and have been really happy with their service. Of course, I'm sure someone will now reply with their WaMu horror story...

Re:The bigger they are...

[eht]

Actually I prefer the big guys over the one credit union I was with, never had a single problem with Citi or HSBC, but Visions Federal Credit Union (IBM's credit union based out of Endicott area) I've had no end of troubles with.

Nickel-and-dime is all they did, right now I owe them over 40$ to close my 20$ account and the number just grows year after year, I get statements from them, but I just shred them.

Re:The bigger they are...

[Reverend528]

Seems like the bigger the bank, the bigger the security breach.

Well, duh. You're certainly not going to see 600,000 peoples accounts stolen from a credit union with only 20,000 customers. That doesn't mean it's any more secure.

Gee how informative

[tofucubes]

I'm glad to know that about 1 in 10 people were notified
I have a feeling that most people's social security numbers have been harvested by people who shouldn't have them

Didn't matter, it was an inside job

[varmittang]

"The case has led to criminal charges against nine people, including seven bank employees and alleged ring leader Orazio Lembo, who operated DRL Associates, a company that advertised as a skip-and-trace collection agency."

Conflict of interest

[__aaitqo8496]

Customer account numbers and balances were allegedly sold to a man who then sold the information to collection agencies, the Hackensack police department said in a statement. Reuters reports that the information has not been found to have been used in any identity theft schemes.

/snip/

The case has led to criminal charges against nine people, including seven bank employees and alleged ring leader Orazio Lembo, who operated DRL Associates, a company that advertised as a skip-and-trace collection agency.

Hmmm... working for a bank and a "collection agency". Sounds like a conflict of interest banks might want to look out for and possibly stipulate that working for a collection agency is not permitted while working for a financial institution.

Hackensack?

[screwballicus]

The data-theft ring may have perpetrated the nation's largest ever banking security breach, a Hackensack, N.J., police statement quoted a Treasury Department representative as saying.

I only hope that Hackensack don't lack the knack to track this crack attack.

Re:Hackensack?

[Reorax]

That is WHACK!

What about the agencies? Will they face charges?

[stomv]

So, the people at the banks will face charges, as will the Lembo, the "mastermind".

But, what about the 40 collection agencies and law firms? Will they face civil charges? Criminal charges? Both? Surely they knew they were up to no good, and they were the ones funding the information theft in the first place -- all so that they could illegally harass debtors.

Will the Feds follow the money?

Screw identity theft...

[Racter]

...do the police intend to track down the information to and "reclaim" it from the collection agencies, advertisers, etc.?

Laws are reactionary

[paranode]

If an individual or group intentionally leaked or sold this information it is most certainly a crime. Laws are a punishment, not a absolute way to prevent crimes. If the perpetrator is convinced they can get away with this and profit from it, then they are not going to be worried about the fine print of the numerous laws they are breaking.

after reading article

[tofucubes]

according to the article at least 108000 customers were notified that's about a fifth

Bank of America (up $0.10 to $46.67, Research), the nation's No. 2 bank, has notified 60,000 customers of the problem. Wachovia (Research) has notified 48,000 customers.

Wow, your country must be great.

[bigtallmofo]

Based on forensic examination of Lembo's computers, it was determined that he had employed upper-level bank employees to access and identify individual accounts in their respective banks," the police statement said.

It doesn't matter what laws you enact. If you RTFA, you'll see that this was an inside job done by corrupt upper-level employees. Setting aside security-Utopia for a second, at some point you have to trust your own employees, especially "upper level" ones. When that trust turns out to be misplaced, there's not a lot one can do to prevent malfeasance.

Re:Wow, your country must be great.

[CarrionBird]

True, but you can make the companies who have the DBs liable for some the damage they cause. (but not take away from the liability of the actual thief at all)

Makes you wonder

[TykeClone]

why so many people use the largest of the nation's banks. They aren't inherently more secure than smaller banks and are larger targets because of the number of customers that they have.

There are several thousand smaller banks in the United States and many smaller banks have lower fees than those giants and a customer actually means something to those banks.

Re:Makes you wonder

[LoverOfJoy]

Because their ATM machines are everywhere? I like my local credit union and they are generally good about fees but when I'm out of town and need to use an ATM I get jacked with fees from both the ATM and my credit union.

Re:Makes you wonder

[Zed2K]

Probably because the larger banks have more of a presence in the towns people live in. I hate getting charged a fee to get to money that is mine from ATM's. Here there are Bank of America machines everywhere. No atm fees, no having to request atm fees reversed.

I've NEVER paid a fee with my BoA account. I don't know how so many people have problems. Free bill pay, free online banking, free bank transfers, overdraft protection, free checking. Hell I even get free checks, not that I write checks anymore though. Only thing I don't like is the horrible interest rate, but thats why I've got a ING account in addition to my BoA accounts.

I've noticed with the small banks (and yes I've looked into them) the online banking sucks, bill pay is a pain in the ass to use and the tellers aren't too bright.

Re:Makes you wonder

[gcatullus]

One of teh biggest reasons is that these large national banks have become large national banks by buying up the smaller ones. An account that I opened about 20 years ago, has gone through 4 banks. I have never had to change account numbers or anything and I think many people just don't liek change, so they stick with what they have.

Re:Makes you wonder

[Thurn und Taxis]

I don't know about the rest of the country, but up in Boston I imagine it often happened something like this:

1. Sign up for an account at Arlington Trust Co., a local bank (1987);
2. Arlington Trust Co. merges with Shawmut (1988);
3. Shawmut merges with Fleet (1995);
4. Fleet merges with BankBoston (itself the result of serial mergers) to become FleetBoston (1999);
5. FleetBoston merges with Bank of America (2004).

In other words, these are the world's largest banks because of a series of mergers and absorptions of the world's smaller banks. And once people have their money in a particular bank, it's not always convenient to move it somewhere else. I personally have my money in a small local bank, but if they merged with a larger bank it'd take a pretty serious degradation of quality to get me to switch.

Be thankful.

[jd]

It is only very recently that States - like California - require the publishing (even to victims) of this kind of information. Had this happened even a few years back, we'd be none the wiser until we'd all been ripped, and even then the banks would likely claim innocence.

(Those from the UK may recall the curious scandal of "Phantom Withdrawls" from ATM machines, where mysterious, large withdrawls were taking place, even though nobody was apparently present to make those withdrawls. It was unimaginably difficult to prove the vitim was a victim, and even then it was next to impossible to get the bank to repay the money.)

check your accounts

[lambent]

/me scans article ... wachovia, pennsylvania ... shit.

Wachovia says that they sent out letters to everyone they know to be affected. My mail service is spotty at times, so I gave them a call. 1-800-WACHOVIA (1-800-922-4684). Just keep pressing 0 till you get an operator. Their customer service workers were able to tell me over the phone if my account was compromised. It's not. w00t! Took them about five minutes, but I think everyone should double check.

Re:check your accounts

[MarkGriz]

"Wachovia says that they sent out letters to everyone they know to be affected"

Sent out letters?
Welcome to the 21st century, Wachovia.

My bank promptly sent me an email alerting me to the problem, and allowing me to log in (via a secure server) and check my account status immediately. Fortunately my account wasn't hacked.

Re:check your accounts

[fafaforza]

And fortunately you were technologically savvy enough to check that the link they sent was a legit one, leading to Vachovia's servers. Many do not know where to even begin to do that.

And you're right. Welcome to the 20th century, where requests to "confirm everything," to "update your personal information," or to change your ATM's PIN number because of an information breach can be sent to thousands of mailboxes in an instant, at no cost at all. Sending out a legitimate looking letter via mail, and trying to extract information from the recipient is much harder, takes much longer, and costs much, much more, and more easily tracked down.

whew

[Himring]

Luckily, I don't use banks. I keep all my money in a thermos under a combination lock. I then tether the combination to a string in a mylor bag and swallow it tying it off on a rigged bicuspid that will send a charge to the bag signaling an incendiary device which will destroy the note unless the tooth is first properly removed. But the bicuspid is fake -- threaded backwards with a one-way screw head. Of course, an anal probe might easily by-pass the oral security, but I recently had my sphincter sewn shut and I only consume nutrient drinks which, by chance, I keep in the thermos....

Stop using big banks

[Figz]

My bank offers:

1. Higher interest rates
2. Interest-bearing checking accounts
3. No fees ever
4. Free online billpay
5. ATM fee refunds (since they don't have their own ATMs)
6. Postage paid envelopes for deposits
7. 24/7 Customer Service with almost 0 hold time
8. No BS

I switched to an internet bank a long time ago and I'll never look back. But I'm not going to tell you what the bank is because I don't want it to turn into a "big bank". Go find your own.

10 is a good start

[Nom du Keyboard]

Account information on the customers was illegally sold by bank employees to a man identified as Orazio Lembo

Everyone involved in this should be in jail Now! Ten years apiece is a good start.

And I don't mean Club Fed either.

I'm really getting sick of this...

[johndierks]

I really feel like that these security breaches are criminal negligence. So far it's been 'All of our customer info has been stolen, we're really sorry."

Holders of mass amounts of critical info need to learn that if they lose it, or mismanage it, that they will be held liable for hundred of millions of dollars in civil penalties, and years in prison for the most egregious cases of negligence.

For Banks, we do

[TykeClone]

It's called the Gramm-Leach-Bliley act.

It has two purposes - the first purpose is to have financial institutions adopt measures to protect consumer data. The second purpose is to add a great deal of paperwork and extra compliance steps that bank staff must accomplish without adding any extra safety to the information.

I believe that in health care, HIPPA or HIPAA (which ever one it was!) accomplished much the same thing.

Can I sell my info before someone else does?

[loggia]

How much are these guys getting?

Like, can I sell my personal information before someone else does?

Re:Can I sell my info before someone else does?

[Teddy_Roosevelt]

Now that you mention it...

Sure, a lot of clear-thinking people get upset to learn their private information has been sold, but I suspect there are also a lot of people who would gladly sell their information for no more than a nominal fee.

I'll bet at least 10% of the population would agree to your getting it all if you offered them $20.

Of course, there's a bit of adverse selection here; the people who would agree to this deal aren't the ones the marketers really want.

It will only get worse

[Amoeba]

This is similar to the Choicepoint breach where account information was sold to an illegitimate company posing as a real customer. The main difference here is that there were "inside guys" who knew the selling of the data was to a bogus firm. What I find most interesting is that the main clients that the perpetrator (Orazio Lembo) sold to were.. wait for it... law firms and collection agencies! Talk about a vicious hive of scum and villiany.

I say it will only get worse because the Sarbanes-Oxley Act is coming into effect which requires companies to put into place access controls to monitor/audit who has access to what information (among other things). The SOX, in conjunction with the Gramm-Leach-Bliley Act are forcing corporations to get their financial house in order in such a way that this type of malfeasance is getting much harder to hide. Expect to see more of the same for quite some time.

While I think it's nice that these laws are having their desired effect I still envy those wacky europeans and their data protection laws.

Amoeba

Glad I opened a new account

[Pedrito]

I have an account with Wachovia. About 6 months ago, I started putting rather significant sums in it. Enough that were the account to get robbed, I'd be seriously upset. What concerned me at the time was that I had used my check card for online transactions, though.

The thought that someone could wipe me out financially by cracking an online system got me worried enough that I opened a checking account at a local bank where I now keep a majority of my funds. I move enough into the Wachovia account for paying bills and stuff that are connected to it, but there's never enough in there to completely wipe me out anymore.

And obviously, with the new bank, I won't be using the check card online. It looks like mine wasn't affected and it doesn't look like the account info was being used for robbery, I still feel more secure with the new account.

The DPA requires a proactive approach

[Colin Smith]

Companies are required to put "technical and organisational measures" in place to protect data.

If you can read legalese. The principles:
http://www.opsi.gov.uk/acts/acts1998/80029--l.htm# sch1ptI

Course, I'm not entirely sure how big the teeth are.

So I Log on to Wachovia's Site and See This...

[judmarc]

Customer Protection

Guard yourself against fraud and identity theft. Wachovia provides the highest levels of protection and stands ready to assist you should you become a victim.

Irony, anyone?

Re:Just called BofA....

[CarrionBird]

Lol, I can corroborate that BofA is feeding you a load of crap. These types don't admit anything they don't ABSOLUTELY have too.

The DPA requires a proactive approach

[Colin Smith]

Actually, a lot of UK companies don't realise this yet either.

But the DPA requires:

"Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data."

Re:What about the agencies? Will they face charges

[4Runner]

Feds said that was part of Phase 2.

"Lomia said the law firms that allegedly sought Lembo's services are part of "phase two" of the investigation."

A simple solution

[Anita Coney]

Some states allow citizens to block use of their credit report. Thus, even if someone steals your SSN, your birth certificate, and your drivers license, they're unable to obtain any new credit in your name, because no one is going to give credit without first getting a credit report.

Sure, it doesn't solve all problems with ID theft, but it certainly helps.

It's not perfect, it can be made more difficult.

[khasim]

If you RTFA, you'll see that this was an inside job done by corrupt upper-level employees.

Yep.

Setting aside security-Utopia for a second, at some point you have to trust your own employees, especially "upper level" ones.

Nope. It shouldn't be that hard to have every employee's access to every account logged.

Then, you have those logs checked by another person, not at that location. Was there a legitimate reason for the access (withdrawl/deposit)? Was that access initiated by the customer?

The people monitoring the logs will not have access to the personal information of the accounts.

Now, if the logs are checked on a random basis (Joe is NOT the only person who checks all of Seattle's logs) then that activity is much easier to spot.

When that trust turns out to be misplaced, there's not a lot one can do to prevent malfeasance.

The key is to build a system where individuals are NOT allowed unchecked access to personal information.

The reason we don't have systems like that is because there isn't any financial incentive to implement them.

The US does NOT have the same privacy laws that other countries have so this kind of activity is MUCH easier to get away with.

Re:What will it take?

[stlhawkeye]

Oops, I forgot Bush ruined class action lawsuits by forcing them to be in federal courts, which are more friendly to businesses.

I don't like Bush's policies either, but let's not just make things up, ok? First, not all class action suits are "forced" to federal court, only very large suits.

Second, they're moved to federal court not because federal courts are more business-friendly, but because of procedural differences in state court vs federal court. State courts tend to be more relaxed in due process procedures, and award ridiculous damages that are confiscated by private law firms. The ease with which a class action suit can be won in a small jurisdiction for enormous rewards has caused capitalistic law firms to seek out groups of marginally damaged people and organize them for a suit. This has caused a tenfold increase in class action lawsuits over the last decade.

Meanwhile, plaintiffs from multiple states with complaints against the same defendant could not organize on a federal level and file in federal court, due to procedural restrictions that prevented class action suits from being moved out of state. Thus you had the dangerous situation of one state's courts determining a case that would have national prescedent ramifications, and this seriously violates the principles of federalism. For a guy who bitched in his post about removing checks and balances, you're also complaining about legislation that was intended to prevent one state from determining national policy via state courts that are cherry-picked by millionaire attorneys.

The legislation in question removed some of the roadblocks to moving large cases with multistate plaintiffs to federal court by granting original jurisdiction of a case to the District Courts instead of the state courts for large suits in which there are multistate plaintiffs.

You then characaterize all this in your tired anti-Bush ranting as some pro-business move that Bush enacted for his cronies. First, that's not how a bill becomes a law, and you ought to know that by now. Presidents do not sponsor legislation in committee, nor vote on them in congress. They sign them.

There are a shitload of legitimate things to criticize President Bush about, but I'm tired of this hate-filled ranting that's misinformed. It's really hard to push for social evolution and progress when most of the people on your side are ignorant and more concerned with politics than anything else.

Oops, I forgot our legislature is too busy removing checks and balances (Senate) and debating corrupt members (House) to get anything else done.

I'm not sure what you're talking about here, so I can't really respond to you. The only major battle I know of in the Senate is over appelate court nominations, and I haven't read anything yet about changes to how nominations are handled.

Big Bank Leach

[NotQuiteReal]

I am a big bank "leach".

I use a "big bank", but as far as I can tell, they make no money off me.

Everything I do with them is "free" - free checking, atm use, etc.

Whenever I have excess money in the bank, it gets swept into an online bank account that pays decent interest, or I send it off to my brokerage account where I gamble it away on bad stock picks ;-)

I buy my checks from random cheapo check printers.

As far as I can tell, I get the benefit of the big bank (lots of atms, grocery store locations, etc) and if anything should happen to my account, security-wise, it's their problem, not mine.

Does this mean...

[nightskier]

that I should start responding to all those "Wachovia Bank Confidential Information" emails?

Interesting Coincidence

[The Angry Mick]

A while back I got a call at around 4:30 P.M. from a credit card company requesting that I verify I had applied for a Home Depot card via one of those "just sign the line below" forms. I hadn't, so I immediately began the tedious process of requesting credit reports and contacting my bank to check up on unusual activity.

Later, at about 7:00 P.M. the same night, I got an pre-recorded call requesting that I call an 800 number and reference a specific "case code". I wrote down the telephone number and the code, and the next day spent a few minutes on Google shagging down the number. Turns out it was for a law firm in Utah that specialises in handling collection cases (unfortunately, I cannot remember their name). I remember thinking, a) "I don't owe anyone any money" and b) "how in the hell did they get my number?".

Now, I guess I know.

The story ended well for me - there were attempts to steal my identity, but they were all apparently stopped. I never did call the collection firm, so I have no idea what they may have wanted to chat about - seems to me if it was important, they would have used a human instead of a tape. The links I followed from Google were mostly to blogs and forum entries relating to how other folks had recieved similar calls from this agency, and upon returning them had been informed by the collection agency that they owed some form of money to an bank/credit card company they were representing. The kicker was that they also tried to add an additional fee (some as high as $275 US), payable to the collection agency alone. Other links mentioned how this same company had been banned from business in a lot of states for trying to add this extra fee, and, in essence, refusing to clear the original debt until their extra fee had been paid.

Re:USAA

[Politburo]

One would hope that this type of thing wouldn't happen with a bank that serves the armed forces.

In a sane world yes. However in a sane world one would also hope that our armed forces could act as prison guards without torturing and humiliating their wards.

Got fired for reporting insecure loan apps...

[RayMetz100]

My old bank fired me for reporting that all daily loan applications including first and last names, social security for borrower and co-borrower and full addresses were wide open on an unsecured windows fileshare with everyone/full control access. All 50,000+ bank employees plus contractors with any windows domain login had full access to view all daily loan applications. These poor people weren't even our customers yet. I knew my manager would do nothing about it, so I started with a standard IT helpdesk call. At least then my report would be logged. Nothing happened. I then tried several other channels and after a few days, I found the "dept in charge of keeping us off CNN". They immediately secured it and were very thankful of my report. Since I had also noticed many other unsecure servers in my time there like daily intra-bank mortgage trade activity and others, I proceeded to report over 15 servers to this group. They fixed everything I reported and were thankful. They advised me not to scan their network because that would be considered hacking, but if I came across unsecured servers over the course of my normal work, I should report it. All was fine until some other managers got back to my manager asking who was the busy-body in his department causing them this extra security work? At bonus review time, my manager all of a sudden gave me poor ratings, disqualifying me from my $6000 bonus. He had given me an out-of-cycle raise just 5 months earlier for good performance. Go figure. After no raise and no bonus, I was pretty ticked and started escalating the issue with his manager and the nice security group. No response. I then put in for a transfer. My manager then writes me up for a written performance issue, listing security as one of the issues, and made my transfer ineligible for 90 more days. I continued to escalate but a few weeks later, he fired me for not addressing the "performance" issues. I've thought about finding a lawyer, but I'm much happier with my new employer now and try to just let it go. Ray

Re:Got fired for reporting insecure loan apps...

[kongjie]

There are laws to protect whistleblowers, but in order to prove that you were fired for whistleblowing and not for other reasons, you had better keep detailed records refuting any claims made by management during performance reviews and the like.

My girlfriend has made a sexual harassment claim against her boss in the past; not only did the claim go nowhere (because said boss is worshipped by his superiors), but now that more than a year has passed, she has received a poor performance review, on the basis of dubious yet difficult-to-refute statements. She too has decided to move on to another company rather than try to fight.

Sucka!

[Grendel Drago]

You would trust any email with a link to go log in to your account? Man, I'm amazed you have any money left to check on!

--grendel drago

It's deja vu all over again!

[Thud457]

If this keeps up, pretty soon we'll all be using the same identity!

Quis custodiet ipsos custodes? -- aparently a blind drunkard that's easily bribed.

Re:It's not perfect, it can be made more difficult

[Anonymous Coward]

Nope. It shouldn't be that hard to have every employee's access to every account logged.

I worked at a large financial institution (life insurance, in a branch of a bank. Hell what I'm saying is 100% accurate so let me say that I'm talking about RBC Insurance - Life, whose offices are in Mississauga, Ontario) a while back, and had full access to hundreds of thousands of customer's data, including specially separated "high net worth" clients. I looked around and realized that on any of the developer PCs (where the user was admin. Actually these morons set DOMAIN\Users as admins, which meant that there was no PC to PC security and any hack could occur by co-opting a coworker) a USB key or PDA could siphon off everything.

Realizes how insanely loose the controls were, I proposed initiative after initiative to tighten up the system, and to add some sort of read logging, but I learned firsthand that financial institutions, presuming this one was par for the course, are 95% politics, and 5% actual concern about customers. The only way any sort of checks and balances were going to be implemented is if it properly gave a handjob to every useless mid-level manager planning their next Machiavellian maneuver (and successfully ensured that I didn't look good out of it, as a shop like RBC is configured in such a way that only the mediocre persist. If you look good, the next time a management churn occurs some clueless twit will purge the clueful). It really was eye opening, and the status quo was maintained and everyone acted like nothing was wrong.

Of course you really have to work in a place like that to fully appreciate how terribly incompetent such organizations are, and to maek it more fun they churn their management around with no logic or thought. Remarkable stuff.

Re:Just called BofA....

[e]

Bank of America has separate computer systems for BoA East and BoA West. I too opened my account in CA, but filled out a credit card form with my family's MI address. The result: I had both a checking and credit card account with "BoA", but couldn't see the two in the same online account manager. -e;

Re:It's not perfect, it can be made more difficult

[soft_guy]

The reason we don't have systems like that is because there isn't any financial incentive to implement them.

The reason we don't have this is because, in the USA, the crooks are writing our laws.

value, protection and economics

[slew]

The way I see it, many of the companies that collect personal information, (banks, radioshack, etc) see little or no value in the information they are protecting, it's only their value of reselling it (e.g., like a pawn shop). As a old tired example, why does radioshack need a phone number when you buy a battery?

IMHO, the goal should be to make economics work for us. The cost of them collecting and securing it should balance the value the get from selling it. Then if the expected return on investment is zero, why would they even bother to collect it? It's just because right now it costs them little to collect it and they can resell it for more is why they do it right now.

One way to get this to assign big penalties to losing control of the info so that the expected cost is high. Another way is to just bill them up front (e.g., tax companies for collecting the information). I'm guessing that in the end, some combination of things would be optimal.

Another thing to look at is to licence people (not companies) to handle information. For example, it takes a registered notary public (not a flunky that the bank assigns) to witness signatures on major business transactions. Why can a company assign some skript kitty to process social security numbers? Why should a bank VP have any access at all? Getting notary public certification is trivial for anyone with a 1/2 a brain, but they make it very clear that your butt is on the line, not the company's butt, so most of them take it pretty seriously. Something about a few hours studying for a test and a name on a license and some personal responsibility makes most folks take their jobs less like a joke (although you occasionally get the rougue CPA or notary, it isn't very common)... Maybe it's time for a certified public information collection certificate or something like that...

Anyhow, that's just food for thought...

If your bank notified you, would you notice?

[DunbarTheInept]

Allegedly the affected customers have been notified by their banks. This leads to a question I have - with phishing being so common, when anyone receieves an e-mail from their bank, do they believe it's really from their bank anymore? Especially when it says it's about an alleged comprimise of their account?

One of the wost things about spammers is that they generate a "boy who cried wolf" problem for people sending legitimate e-mails.

Did they promise unbreachable security?

[glrotate]

No, nor did they promise the bank president wouldn't take all of my money to buy coke, hookers, and a ticket to Fiji.

In the law there are such things as due dilligence, and negligence. Some of these organizations need to get hit with a massive lawsuit in order for the message to be sent loud and clear.

Normally Windows, but Solaris is 3 here.

[WindBourne]

Normally, the break ins involve Windows (in fact, Windows has some 40% of https space, Yet, has more than 95 % fo the thefts). But here windows is only 1 out of the 4. Solaris accounts for the other 3.

That assumes that they really are on the these sites. With the big break-in that occured with Visa/MC/Discover about 1-2 years ago, it took awhile, but they found a Nebraska clearing house running windows had been broken into, not the CC sites.

Re:It's not perfect, it can be made more difficult

[ArghBlarg]

Have you ever considered blowing the whistle on their lax security? Really -- contact some media outlets, try to contact large stockholders etc. It's the best thing you could do for the people whose data is held there. You'd be doing a service to society at large.

Deliberate misnomer this 'identity theft'.

[Senor_Programmer]

It's plain old fraud and the onus should be on the merchants and lenders who fail to verify the identity of the person they are extending credit to.

But no, this is too costly, so they try to put it back on the person who's information is used in the fraud.

It's NOT RIGHT! If someone else borrows money in your name, it's the lenders problem, not yours. Your identity was not stolen. You are still you. The lender is at fault because he failed to exercise due diligence in a climate where fraud is rampant.

Just think about it for a minute. You are NOT the victim of identity theft. You are still you and the other guy screwed some third party. Why should it cost you any money or any time... Instead, the idiots who carelessly or out of greed failed to verify that it was indeed you and not someone else requesting a credit report and credit should pay.

There's a simple solution too.

The credit reporting companies need to stop selling information to anyone other than the person who owns the information. Mainly you if it's your information. You want a loan, you request the information. Hell, if it takes a photo ID and a visit with a rep from the reporting company, then that's what it takes... But it's their problem to solve, NOT yours.

Wells Fargo has BOA beat by a mile!

[funk49]

Wells Fargo has *THE* worst security of all the large financial institutions.

Last year, I received a notice that my personal info was on a system of theirs that was compromised. I called the customer support number given and inquired about what happened. Turns out, a laptop at a billing facility (yeah, i know...a laptop) was stolen along with a few others in a physical security breach.

On that laptop was the personal info (SS numbers, addys, everything) of 300,000 account holders. Yes, that's right...300,000! Worse part is that this same scenario has occurred 3 times in the last 2 years!

Wells Fargo's CSO and CISO should be flipping friggin' burgers instead of providing security as they are
setting the standard for how bad you really can be.

Hey Wells Fargo asshats, ever heard of getting some kind of policy and compliance audits going?

Re:What will it take?

[peachpuff]

"Second, they're moved to federal court not because federal courts are more business-friendly, but because of procedural differences in state court vs federal court. State courts tend to be more relaxed in due process procedures, and award ridiculous damages that are confiscated by private law firms."

No, the point was that laws and typical awards vary from state to state. It used to be that you could just pick a state: if a company does business in five states and screws people in all five of them, you could pick any one of the five. If one of the five is friendly to plaintiffs, you'd pick that one. That doesn't mean that all states are plaintiff-friendly.

You could say that the old way was unfair, but I think if you do business in a state you should be subject to its laws. It's certainly more fair than all these companies incorporated in Delaware, where they have no customers but lots of friendly courts.

Also, it makes no sense to claim that the President can't be responsible for a law. I don't know how hard he pushed this particular bill, but he's the most powerful person in the country and the leader of the majority party. His support makes a huge difference in whether a bill gets passed, as he or any member of Congress will tell you.

All the way to the bank.

[Doc Ruby]

The people who stole this info were insiders, high-level employees of the bank. They committed the theft, they're responsible. The bank employed them, and was responsible for their actions. Just like if their security guards stole the money you deposited from a vault, before computers, they're responsible. Unless they found that the employees had breached the security protocols in some unpredictable way, not that the protocols were inadequate. Like relying purely on unaccountable trust of single employees without witnesses, as apparently in this case.

When we put our money in the bank, we reasonably expect they won't leave the door unlocked. When they do, or trust someone with a key, they are responsible. It's not each customer's responsibility to audit their security: that's what we have the Treasury, many other government organizations, and professional integrity to rely on. When a bank enables damages by allowing cracks in that security apparatus, they've got to pay the cost.