Slashdot Mirror
Chase Data for 2.6 Million Ends up in Landfill
svonkie writes to mention a ComputerWorld story about some bad news from some 2.6 Million Chase credit card customers. These folks are being told that tape backups with their information were mistakenly thrown away back in July. There's apparently no need to worry about possibility of compromised personal information; the company believes the tapes were destroyed at a landfill. Just the same, "To prevent similar incidents, Chase said it is strengthening its security procedures and is conducting a review of all data storage and protection processes. Chase began notifying the affected customers about the incident yesterday and said the process is expected to take two to three weeks. The company is offering one year of free credit monitoring to people whose Social Security numbers were on the tapes."
if they think the tapes were destroyed, how do they know exactly which card numbers were on the tapes? I mean they may know the bulk, but not all, right? or would they? If they got rid of the tapes, would the still have the indexes?
Is this data not encrypted!?!
Yikes! A dumpster diver's paradise!
Check out my sci-fi/humor trilogy at PatriotsBooks.
These folks are being told that tape backups with their information were mistakenly thrown away back in July.
Well, they better go Chase it!
The theory of relativity doesn't work right in Arkansas.
Company spokesman says, "Ooops. Our bad. Please, Mr. Government, whatever you do to punish us, don't give us lots of money. We hate that." Government officials are trying to determine how much money to punish them with.
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
Gee, what if this was an inside job, and they
were placed in the trash to be retrieved later
before making it to the dump?
You are being MICROattacked, from various angles, in a SOFT manner.
...thinking that the tapes were destroyed is not an acceptable answer. From a PR standpoint they should've just lied or said they were taking actions to make sure they were destroyed.
The article summary posted above fails to mention that these were Circuit City credit customers. That is a very important bit of info as many retail credit card holders often have no idea who the issuing bank is.
I say they nuke the site from orbit. It's the only way to be sure.
When our name is on the back of your car, we're behind you all the way!
Is it just me, or is the whole "pay for" credit monitoring industry a big con?
You have to PAY to find out what information may or may not be stored about you? It may be correct; it may be erroneous: you don't find out until you've stumped up the cash (and yes, I realise that the credit companies are required to make information available in the event that you are turned down for credit... but what about those who are just curious?).
And in this instance, what happens when that year is up?
Now we know where this guy funds his science projects and student loans.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
There's a news summary on their main web page:
Circuit City Customers
Chase is notifying a segment of Circuit City credit card account holders that computer tapes containing their personal information were mistakenly discarded.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I worked for Chase when this happened.
The guys couldn't find the tape(s) and were SURE that they had ended up in the storage locker...
Guess they couldn't find them there...
--E--
To prevent similar incidents, Chase said it is strengthening its security procedures and is conducting a review of all data storage and protection processes.
How in the world would they just now find out that they threw such a thing away if they weren't already conducting some kind of review like that? The truth must be that they were already conducting the review, found the prior mistake, and then used the review as a way of atoning for the mistake.
Have you ever wondered How to Take Over
Inconceivable! You keep using that word. I do not think it means what you think it means
I used to work at a Chase subsidiary, and no amount of IT incompetence from them surprises me. Frankly I'm shocked we were never sued into the ground with the idiotic things they did; for example, sending out tax forms for RV loans late, resulting in customers losing tax refund money; also (it was a "loan servicer") we'd call people 3x or more/day after they'd already spoken to us.
The corporate intranet webshite had a form that all employees had to agree to yearly. My section all did theirs after I did, and each time they logged in *on different machines and with different accounts* the form thought they were me.
I know I could name many more things, but it's been a couple years and I've successfully blocked out most of those memories.
That suggests a limited imagination. It's easily concieved by anyone who's been following such news recently. What may be inappropriatelyconceivable is that there's a company that could never do such a thing -- if it's possible, it must be that they don't employ humans.
I have a Chase Circuit City credit card. Why am I first hearing about this on Slashdot instead of from an email from Chase?
Ahh... you mean like:
+ million+accounts/2100-1029_3-5751886.html
CardSystems in Tucson, who lost 40 million Visa and Mastercard account records. CardSystems is one of several companies that process transactions for banks and merchants.
http://news.com.com/Credit+card+breach+exposes+40
I know this for a fact, because of all the spam I keep getting telling me to fix the particulars of a Chase bank account which I have never had in the first place. Obviously there are bit errors in the data :-)
Someone had to do it.
> So what it came down to is someone not doing the proper procedure.
I think they missed the fine print in step 3:
Chase Inc.
Procedure manual.
Page 1.
While cleaning out the server room:
1. Place trash barrel in center of room.
2. Remove tape from backup drive.
3. Toss backup tape across room to storage rack on opposite side of room.*
4. Collect all trash and place in trash barrel.
5. Bring trash to dumpster.
* Be sure not to allow tape to land in trash barrel.
There are 0x40000000 types of people: those who understand 32-bit IEEE 754 floating point, and those who don't.
Interesting timing. Just a moment ago I opened my mailbox and found a letter from the Department of Veterans Affairs. It seems they found the stolen hard drive that contained personal info on 26.5 million veterans. According to the letter, the FBI found the laptop and hard drive.
As a further backup, the VA has "obtained data breach analysis services as a means of further ensuring no misuse of this data occurs in the future."
Like Chase, the VA is "throughly examining every aspect" of their information security program. In the case of the VA snafu, an employee took the laptop home in violation of VA policy. The rash of these incidents makes me wonder how we can expect any sort of large organization to keep a lid on data spills like these, given that most people can't be bothered with basic security precautions even on their own computers. Even if the VA spends millions upon millions of dollars upgrading their security technology and processes (which of course will draw the wrath of opponents of government waste), I'm not sure it will make much difference.
Read the EFF's Fair Use FAQ
Er, parent post isn't offtopic. He's referring to the firefly episode "Trash", wherein a heist is pulled off by dumping a valuable object in the trash to avoid it setting off alarms on the way out. The valuable item is then retrieved from the trash bin before it makes it to the dump.
I was helping a VERY untechnical office staff (most around 50+ years old) move to a new building and while going through the basement, we found floppy backups of their medical and insurance info and they told me they didn't need ones older than 10 years, which there were some of. Before I even said it, they suggested we destroy them somehow because of the sensitive data on them. I ended up putting a scissors blade through a couple hundred floppies, 3 at a time (that was FUN!) But if 50+ year old doctors know that they need to destroy stuff that holds customer data, who the hell would be stupid enough to just throw out tapes? Obviously someone Chase.
now stop reading and go play Dance Dance Revolution!
As you wish.
[duck]
--
dman123 forever!
Filtering out the -1s and 0s since 1999.