Slashdot Mirror
3.9 Million Citigroup Customers' Data Lost
Rick Zeman writes "CNN.com is reporting that United Parcel Service has lost backup tapes containing the identies of 3.9 million Citigroup customers. According to UPS, '... a "small package" containing data storage tapes was lost while being transferred to a credit reporting bureau.' According to Citigroup, they 'included Social Security numbers, names, account history and loan information about retail customers, and former customers, in the United States.'"
These companies are treating this information far too trivially. Laws need to be passed that will make this type of carelessness illegal and/or compensate these customers for losing their info. I think the lack of trust from customers would be incentive enough, but obviously it isn't, so more needs to be done to prevent these fiascos. And on another note, why aren't more consumers, in this day of rampant identity theft, completely outraged by these events. What is this the fourth incident in the past few months (and I'm probably lowballing the number)? This is simply unacceptable.
"Plans are for fools! Oglethorpe, the plutonian (Aqua Teen Hunger Force)
If we create legistlation that makes losing customer's personal information a criminal offense, then maybe these giant megalomerates will stop collecting (and abusing) it.
just because you didnt hear about things like this in the past doesnt mean they didnt happen.
http://www.rayn.net . Funny. Stuff.
When their customers actually start caring and making them realize how much of a mistake losing our data is? This will affect nearly nothing (because most people won't hear about it and many who do won't care), and business will go on as usual. If the customers actually took a stand, maybe we'd see some improvement.
I used to work for UPS customer service. I'd say at least .1% of all packages either get damaged or lost during shipping. Shipping packages of low value is no big deal, your losses over time will be minimal. Shipping packages of high value, however, will result in considerably larger losses over time.
DO NOT SHIP YOUR HIGH VALUE GOODS VIA UPS/FEDEX/DHL/ETC. I cannot stress that enough. Hire a private courier. Hire someone in your company. Drive it yourself. Find someone with better than a 99.9% success rate if your package is worth millions.
I never really understood why they called it identity theft. Much like I can't understand why they call it "stealing" music. Nothing's actually gone -- it's really more of an identity infringement.
Try not. Do or do not, there is no try.
-- Dr. Spock, stardate 2822-3.
The only way to solve this is to attach a cost to personal data. As soon as you do this, companies will instead of trying to collect as much data as they can, treat it (rightly) as something they should collect as little as possible. Lost data should have a cost to it which sends shudders down the spine of Chief Financial Officers.
I expect this will take a big class action lawsuit, but if I were a company of any size which handled confidential client data, I would be scrambling for a way to reduce my liability.
I'm not wrong. You haven't thought about it hard enough.
As this is just another in a long string of weekly "your vital data stolen" stories, I'm starting to wonder: have big companies always been this fucking careless, and it's only due to SOX et al. that we're learning about it now? I'm not even sure which I'd prefer.
Media that can be recorded and distributed can be recorded and distributed.
-kfg
You have to be kidding me. UPS? To transfer secure information? Where I work, we receive a backup tape from a production system that we load that contains sensitive data. That tape is sent back to my group via Iron Mountain (and we send the old tape back the same way). And this isn't even stuff as high profile as like what's Citigroup apparently lost. When services exist like this to facilitate occasional, VERY important shipments, there's just no excuse using UPS or Fedex. I fear for the free market if this is "business as usual" for it.
These are the people that would pay through the nose for armoured car to truck their cash around, but would send huge amount of customer information through UPS.
ELOI, ELOI, LAMA SABACHTHANI!?
will be taking their business elsewhere
i am moving from BofA after their mishap.
Somewhere smaller, hopefully more secure.
Hit them where it hurts!!!!
I guess not, otherwise this would be a nonissue. It is unbelievable that in this day and age a company the size of Citigroup would ship unencrypted tapes. Geez, it is trivial to do and a no-brainer. Really, whoever is in charge of IT security policy there is an idiot and should be fired immediately and any security credentials (like CISSP) stripped so he/she can't pull another fast one on some other company. This is the height of absurdity and irresponsibility.
CitiGroup no doubt spends millions each year on network encryption for data transmitted across WANs. I wonder if the data on these tapes was encrypted? Since they're "backups", I doubt it. Sure, UPS screwed up the sensitive task entrusted to their expert professionals. But CitiGroup took an unacceptable, unnecessary risk by allowing the task to be so sensitive. They should all have to indemnify every exposed CitiGroup customer from identity crimes in perpetuity, including the time the customers spend managing this exposure.
--
make install -not war
As soon as it starts costing them money not to. That is the *only* way they will change.
-John
There is definitely something wrong with this system! I'm all for doing without consumer credit, but it's simply not feasible.
Perhaps we need a public-key style scheme where we generate a unique private key that we use to encrypt things like credit card applications, and then the public key is on file with the government and credit card companies and the like. That way only we have access to important private information, but the credit reporting agencies and the government can still keep track of us the way they do currently.
This would beat the hell out of biometrics and nonsense like that (you can't bloody send someone a retina scan over the internet or through the mail!), and it would do something to improve our privacy by preventing people from faking your identity.
Isn't this the second time (or more, most likely) that a set of shipped customer has been "lost?"
It's quite possible that the scum of the universe that feeds on harvested identities has gotten sophisticated enough that they are now able to identify such in-transit packages and have them go missing.
Bottom line -- companies should not be shipping this type of information via common carriers.
Having myself been lectured (and inappropriately, by the way) by Citibank employees about how it's my own fault my credit card interest rates went up (it wasn't, by the way), I hope at minimum that someone sits down the entire senior staff of this company and lectures them like they were children for many hours, making them feel as embarrassed and disrespected as they routinely do to their customers.
And then, just to make the point, they should have to pay not just whatever court-assessed penalties, but that amount plus 24.99% retroactively applied to the entire amount backdated from the time they finally pay all the way back to the time of the incident, just like they're always raising people's interest rates to unreasonable amounts like that even retroactively on purchases already made, and to ensure that they pay in a timely way.
And it goes without saying that reparations should be paid personally by the people who run the company, not passed along to customers.
Kent M Pitman
Philosopher, Technologist, Writer
"I never really understood why they called it identity theft. Much like I can't understand why they call it "stealing" music. Nothing's actually gone -- it's really more of an identity infringement."
Give me your social security number and I'll be glad to demonstrate what's "gone".
Don't ANY of the CEO/CIO's, auditors or even PR people at these places read the news.
Doesn't even one of them think for a moment - "Huh? I wonder what we are doing to make sure that this doesn't happen to us?"
I'm not one for endorsing additional legislation - but perhaps if we held officers liable (SarbOx style maybe) for these breaches, then maybe someone will start to care.
It's not often that +5 insightful and +5 funny belong to the same comment, but it seems to fit here. Indeed one of the funniest, if quite obvious, comments I've read lately. Thanks for laugh.
The Chronic *WHAT* les of Narnia!
I expect this will take a big class action lawsuit...
There's certainly better ways to solve this problem than the "let's make them afraid of lawsuits" method. Fear of reprisals tends to motivates people to cover up their mistakes, shift blame elsewhere, and so on.
Litigation is the same kind of "solution" that the US medical system has been using for some time, and it has contributed to having, by far, the most expensive medical system in the world, without commensurate quality.
Rather than going down that road again, we should be more proactive about protecting personal information. Here's just a few things we need:
They are unaccountable. Try complaining to your states AG about your bank or CC company. You'll be told that the OCC (Office of the Comptroller of the Currency) has jurisdiction. Want to complain to them? Well, they'd probably listen if they weren't staffed by governmental appointees and ex-industry insiders.
Want to sue? Sorry, but you've probably already given up that right under an "arbitration" clause. One could try a class-action suit, I suppose, though that avenue's been largely gutted by the "Class Action Fairness Act".
So what if the industry looses a few more dollars to identity theft? They'll just raise interest rates, late fees, and overlimit charges to make up for it.
No problem.
Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.
Encryption is that difficult eh? How about using a simple XOR of a key on the data. Takes like 2 or 3 lines of code. Not the most complicated encryption, but atleast its SOMETHING! Theres more complicated ways of doing encrytion but having none at all is just stupidity in action.
What, you think there's something special about C-bank? No, they're the rule, not the exception. Every financial institutions cares just about the same amount about your data, and your life - in fact, the only money they really watch out for is the huge sums the company gets to keep for itself - THAT money (and the company's data) gets MUCH more carefully guarded!
My rule these days is, giving away information that you don't have to is like giving whiskey and car keys to a teenager. So apply for the credit card, but just write "disconnected" in the phone number box. Use several free email addresses and make sure they're evenly distributed as contact drops. Make a "mistake" in estimating your exact gross annual income, when reporting it to anybody but the IRS.
The point is not to be subversive, but just to be realistic. The information age has spawned a paper-happy beuracracy driven by bean-counters who want you life history at every other step. Check it yourself - 90% of the data that you go though life writing in little boxes is simply dropped into a filing cabinet unread, unneeded, and ignored. I've gotten driver's licences with no address (just a PO box!), paycheck stubs with no SS number on them (you can ask to get it removed), and once got Household Credit to approve "Barney the Purple Dinosaur" for a credit line of $250. (To the best of my knowledge, the address I did this at *still* gets offers for him...)
Most of the people who key the data from your form to the computer do not even speak English! In fact, the most likely method for your data to be read is for the processing center to OCR-scan (or flat picture scan) it into a computer, where the images can then be beamed to the lowest-bidding Malaysian crack monkey (anywhere in the world) who "reads" the picture of your data and keys it in. And they're feeling the pressure from machine-AI reading programs, which are able to translate more and more of your hand-writing with a higher percent-chance of confidence every day.
Bottom line, if you throw a "Jr" onto your name half the time and half not, or only use your middle initial as the fancy strikes you, you're lying to no-one but an SQL database app, and you're only doing what little is in your power to confuse would-be identity thieves; necessary in a world that will always refuse to protect you!
Then when that gets cracked there'll be 500+ messages on /. about how stupid they were for doing something so simple and how they should be protecting our data better than that.
What Citibank did (shipping unencrypted sensitive data by UPS):
1. Is or at least ought to be a crime. People there should now be looking forward to jail time, not just fines.
2. Some customer affected should initiate a class-action suit. Damage was done.
3. Why don't they (and the authorities) make the obvious assumption that the data was stolen, not lost?
Not at all. But with regards to the recent bankruptcy bill, I see it as two wrongs, compounded by a third and bigger wrong.
* Wrong #1: People who use credit cards unwisely. Nothing good about this, and I won't defend it.
* Wrong #2: Credit card companies that push credit on people with relentless advertising. Then they advance credit to just about anyone, and are happy, even eager, to up your credit line. IMHO, they are knowingly making bad loans. This used to be known as "bad banking" and was punished by bad profits.
* Wrong #3: After years of making bad loans, and starting to see personal bankruptcies rise as a result, the credit card companies buy legislation to "close the loophole." They have been taught nothing about prudence in loaning, at all. Neither side is right in this. But the bad part is what happens to that original background of bankruptcies, before this credit abuse bubble. This bill is catching some of those legitimate bankruptcies and turning them into lifetime debtors.
The living have better things to do than to continue hating the dead.
Just exactly how am I supposed to 'take a stand'? Believe me I'd love to, but I feel there's nothing I can do. I'd like to get a loan through another company, however I don't know of any credit union or smaller banks that do anything like that.
Hence it follows that they'd also have to be forgiven in case they'd used a simple encryption scheme. After all the same unreasonable people would complain.
Hence they'd have to be forgiven if they'd used no encryption .... Basically, because someone would always complain they are always guiltless, no matter how careless they were. :-)
Secure file transfer is a solved problem. There are several options available for secure file transfer which don't require any more coding than a simple shell script -- scp, sftp, nfs or rsync over an ssh tunnel, etc. You can easily replicate a relational database in real time over an encrypted channel using a VPN.
Even if you require a custom solution, you don't need to implement your own encryption algorithms -- there are open-source crypto libraries available for virtually every language and operating system imaginable. Not only is reinventing the wheel foolish, when you're talking about cryptosystems, it's downright dangerous.
Why is it that the proponents of "one nation under God" are so eager to get rid of "liberty and justice for all"?