Slashdot Mirror
US Bank Regulator Notifies Congress of Major Data Security Breach (metro.us)
A U.S. banking regulator says an employee was found to have downloaded a large number of files onto thumb drives a week before he retired. When the former employee was contacted, the Office of the Comptroller of the Currency said he "was unable to locate or return the thumb drives to the agency." The reassuring news is that the information appears to not have been disclosed to the public or misused in any way, according to the OCC. Metro.us reports: Before he retired in November 2015, the former employee downloaded a large number of files onto two removable thumb drives though the incident was only detected last month during a routine security review, the OCC said in a statement. The stolen data was encrypted, the agency said. The Office of the Comptroller, along with the Federal Reserve and Federal Deposit Insurance Corporation, is one of the nation's three most influential bank regulators that is tasked with protecting consumers and financial markets. The OCC has deemed the breach a "major incident" because the devices containing the information are not recoverable and more than 10,000 records were removed, the agency said. The official, who was not authorized to discuss the case, noted that a large batch of unclassified personnel records were among the cache.
Contacted? With handcuffs, I presume?
Elect that employee President of the United States.
Old people don't seem to get how important personal information is. Back when I was in school, this old fart used our SSNs and DOBs for our userid and pw for a job website - an external company. He retired the following year. The person who took over was beside herself over her predecessors stupidity.
These old people don't realize that this information goes all around the World and we don't know who has access.
Bank of America's databases of customer data is all handled in India. So are the credit bureaus. I had a problem with my report for Equifax and they sent me to an Indian call center that had ALL my information.
I am just waiting for the day that the black helicopters land and shit my ass off because some terrorist used my identity in Derkaderkastan.
I guess some guys aren't content with just swiping Post-It notes. FFS.
<snort> AH HA HA HA Stop it! As if... <snort> HEE HEE "US banking regulators" <giggle> Did they mention what the unicorns and tooth fairies were up to?
Some bank data has passed over the Internet, among various banks. The US Government has classified it as a major breach because foreign actors, criminal syndicates, and nefarious Trolls might have access to the data as it passes over the public Internet, and because the data of almost every citizen of the world was affected by the breach, which may be ongoing. The data was encrypted, says the government.
Mohammed: Did you see Mohammed at the meeting today?
Mohammed: No, but his brother Mohammed showed up.
Mohammed: What did Mohammed talk about?
Mohammed: Mohammed introduced us to Mohammed who is also a mason!
Mohammed: A mason? No shit? How long has he been one?
Mohammed: About five years. He was referred to the local lodge by Mohammed.
Mohammed: Ah, yes, Mohammed. He has a shit ton of connections around town!
Mohammed: Yes, and our brothers, police be upon them, Mohammed and Mohammed from Egypt came, too.
Mohammed: I've been thinking of becoming a clown.
Mohammed: A clown, Mohammed, why?
Mohammed: So I can film myself being gay.
Mohammed: Oh, you.
Mohammed: So anyway, is Mohammed, Mohammed, and Mohammed coming to the next party?
Mohammed: Indeed. Mohammed was so funny last time.
Mohammed: Well it wouldn't be a party without Mohammed.
Mohammed: Yes, my friend. POLICE BE UPON THEM!
Great!
Just like in the movies, thumb drives are enabled and auto-magically work in all banking hardware/workstations I assume...
At least, they seem to have a non real-time system that reports "incidents" months later.
I have seen places where, non only can't you access anything from a thumb drive, but security guards auto-magically appear at your desk if you try to plug one in.
Everything I write is lies, read between the lines.
...this could have been prevented with a six-dollar tube of epoxy from the local Wal-Mart.
Il n'y a pas de Planet B.
Any kind of control of personal computers and personnel seems to be impossible. It's back to the terminals time for every regulated industry, agency or entity handling regulated information.
OK, let me get this straight. A guy steals 2 thumb drives worth of data. When it is discovered, they go ask the guy, "Hey, where are those 2 thumb drives with the data you copied before you retired?". The guy says he can't find them but didn't do anything with them that he shouldn't have, so the investigators breathe a sigh of relief and say "Well, that's good, let us know if you find them.".
If he copied the data, he broke the flipping law to begin with, why in the world would you believe him when he said he didn't give / sell the data to someone who is going to use it illegally?
You have got to be kidding me! Is it April 1 and I didn't realize it?
We encrypt sensitive data at my company. Of course, I know how to decrypt it.
Who downloads lots of useless stuff right before they leave a job?
I better explanation of the situation would be this: The man decided that the company retirement plan wasn't good enough, so he took steps to supplement his income. He couldn't return the thumb drives because they were no longer in his possession. You know, sort of like he might have exchanged them for something of more use to him...
I know I've been talking about rolling out a group policy to disable USB drives across our enterprise, but I get told I'm being controlling.... They have been our largest infection vector and, like this post shows, an easy way for data to walk out the door without an audit trail.
Shouldn't the free market solution be to inform everyone's who's account may be compromised and let the bank fail if everyone flees from it? I keep hearing about how great the free market is but never hear about entrenched systems practicing what they preach.
Anons need not reply. Questions end with a question mark.
Nothing here or in the article indicates if the information was downloaded as part of this individual's job responsibility. The article does call the information stolen but offers no support for that. The company is at least equally at fault here for PII being misplaced. Why were the USB ports enabled on a device that had access to sensitive data unless this was approved behavior? Why was there no DLP solution in place monitoring in real time a device with access to sensitive data and enabled USB ports and presumably internet access?
I heard that only CowboyNeal has the key.
It seems the bank officials, or the reporters, don't understand the difference between copying information, and deleting information.
It was considered a major incident "because the devices containing the information are not recoverable and more than 10,000 records were removed"
The original records in the bank servers were almost certainly not "removed". That's not what happens when you copy something to a thumb drive.
The fact that the devices containing the information are not recoverable is also PROBABLY good news, in that they were probably misplaced in the person's residence or trashed. In either case, the sensitive data is probably not usable in the wild, so that would count as possible good news, not probable bad news.
Stealing information does not deprive the original owner of the information, get it straight.
It only deprives the original owner of exclusive access to the information.
What is then important is what becomes of the unauthorized copy of the info. Is it all over the public internet, or sold to spies/criminals, or not. If not, then no biggie.
Where are we going and why are we in a handbasket?
All external USB ports should have been removed. If the printer needs a USB port then a password protected bluetooth unit should be utilized.
> The official, who was not authorized to discuss the case, noted that a large batch of unclassified personnel records were among the cache.
What does it mean when an official who was not authorized to discuss the case goes ahead and discusses it?
Maybe at the Office of the Comptroller of the Currency there's a culture of not following the rules.
I bet 99% of the staff can't figure out how to plug in a flash drive into a MacBook... The new pro models have 3 ports open of the wrong type but the MacBook would be charging on it's only port.
Democracy Now! - uncensored, anti-establishment news
Always found that to be a weird, almost made up word.