Data Theft Notifications - How Soon is Too Soon?

bsdbigot asks: "I started getting a bunch of stock-tout spam in the last month or so. The other day, I happened to look and see it was coming in to an email address I had dedicated to my online trading account account. I've spoken to the online trading company, and I've given them the info on these spams. It turns out there is an 'ongoing investigation,' which includes 'outside agencies,' but they stop short of saying that there is any theft or breach. How soon should such a company let its customers know that their data has been compromised? Should they wait until they have all the details and have plugged the breach, or should they let customers know that there is a possible problem as soon as they recognize it?" "Personally, I believe a security breach has occurred. So, I asked them how many people are affected by this; they feel certain that it's an isolated problem, because they haven't received a deluge of complaints. They don't know how these spammers got my reserved email address from my online broker (but they didn't sell it, they are quite clear on that), so how can they be so certain it's not their entire database, and how can they be so sure that things like my SSN and bank routing information wasn't also stolen?"

Comments

Do more

[omeomi]

They should do more to keep it from happening in the first place. Seriously, there's a new breach at some major corporation or government office every other week or so. It's ridiculous.

Re:Do more

[AusIV]

That's easy to say, but it's really not so simple. Some data leaks happen because of software issues. More likely an employee figured they could make a buck selling data. Hiring more trustworthy employees requires paying more money, and that has to get passed on to the customers, who in turn take their business somewhere cheaper and less trustworthy. Customers want security, but they're not willing to pay a little extra for it.

Re:Do more

[omeomi]

Hiring more trustworthy employees requires paying more money, and that has to get passed on to the customers, who in turn take their business somewhere cheaper and less trustworthy

For companies and agencies that have to have highly sensitive information like SSN's on file, there should be an exceptionally small number of people who have access to that information. A small enough number that I can count them on one hand. And none of those people should ever be allowed to take any portion of that list out of the system in any way, not on a thumb drive, not on a laptop, nothing. The vast majority of the employees should only be able to access the last 4 numbers of any given person for varification purposes.

Re:Do more

[houghi]

For companies and agencies that have to have highly sensitive information like SSN's on file

First start with the fact wether or not the company needs the SSN or not. When in doubt, the answer is no.

employees should only be able to access the last 4 numbers of any given person for varification purposes.

It is a Social Security Number, not a Person Verification Number. If you use it for anything else then for Social Security reasons, you do not need to get it in the first place.
The best way not to loose the data or be tempted to sell it is not to have it.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:How stupid is E*Trade?

[jfengel]

I would expect that a spammer would automatically strip out anything after the +, but I don't have any experimental data on that.