As we begin a new year, I thought it would be a good time to reflect upon some major information security breaches of 2009. The list of the organizations involved makes this list very interesting. What makes this list even more interesting is the analysis of the breach- which indicates that the incidents could have been averted by adopting some fundamental security best practices.
Organisation Analysis of Breach Impact
| Heartland Payment Systems | For Heartland, a Princeton, N.J.-based payment systems company, the initial warnings came from Visa and MasterCard. Their concern: Suspicious processed credit card activity. Turns out that Heartland was the target of one of the biggest cyber-fraud schemes ever, one allegedly carried out by a former Secret Service informant and Russian hackers. Almost three-dozen separate lawsuits on behalf of consumers, investors, banks and credit unions have been filed against Heartland. | Number of records affected:
More than 130 million credit and debit card numbers from Heartland and Hannaford. |
| Metro Nashville School | Public Consulting Group, a private contractor, unintentionally put student data on a computer Web server that wasn’t secure, and the data was available online for three months. | Number of records affected: 18,000 |
| Federal Reserve Bank of New York | A former employee of the New York Fed and his brother were arrested on suspicion of obtaining loans using stolen identities. The ex-employee previously worked as an IT analyst at the bank and had access to sensitive employee information, including names, birthdates, Social Security numbers and photographs. A thumb drive attached to his computer was found to have applications for $73,000 in student loans using two stolen identities. | Number of records affected: Unknown |
| Virginia Department of Health Professions | “Give us $10 million, and we’ll return the millions of personal pharmaceutical records we stole from your prescription drug database.” That’s essentially what hackers told the state of Virginia in May. Did they have the goods? A notice posted on the Virginia DHP Web site acknowledged that the site “is currently experiencing technical difficulties which affect computer and e-mail systems.” | Number of records affected: Potentially 531,400 |
| University of California, Berkeley | Hackers infiltrated Berkeley’s restricted computer databases, possibly stealing personal information of 160,000 current and former students and alumni. The university said Social Security numbers, health insurance information and non-treatment medical records dating back to 1999 were accessed. The breach was discovered April 21, when administrators performing routine maintenance identified messages left by the hackers and found that restricted electronic databases had been illegally accessed from Oct. 9, 2008 to April 6, 2009. All of the exposed databases were removed from service to prevent further attacks. | Number of records affected: 180,000 |
| Internal Revenue Service | The IRS dumped old tax returns at a dozen disposal facilities, old returns were tossed out in regular waste containers and dust bins. This work was being conducted by contract employees who, of course, have access to sensitive taxpayer documents but who, the IRS admitted, may or may not have passed background checks. Another problem: the agency wasn’t sure who was supposedly responsible for overseeing the burning or shredding of tax documents at the 12 IRS offices involved. | Number of records affected: unknown |
| Aetna | Current and former Aetna employees’ Social Security numbers may have been compromised as the result of a Web site data breach. This was the result of a spam campaign in which intruders obtained email address and possible SSNs from the Aetna Web site. Aetna notified the 65,000 people whose SSNs were on the site and was subsequently sued in a class action suit demanding credit monitoring, punitive damages, cost and other relief for former and potential employees. | Number of records affected: 573,000 |
| Network Solutions | Those damn hackers. Breaking into Web servers provided by e-commerce hosting provider Network Solutions, hackers were able to plant a rogue code that ended up compromising almost 600,000 debit and credit card accounts over a three-month interval. The hackers were able to intercept personal and financial data from customers purchasing goods and services from Network Solutions’ 4,343 clients. Most were SMBs selling online. | Number of records affected: 573,000 |
| National Archives | When a hard drive used for eVetRecs, the system through which veterans request copies of their health records and discharge papers, failed late last year, the National Archives and Records Administration sent it to GMRI, the contractor that sold it to the agency, to be fixed. GMRI decided it was beyond repair and sent it to another vendor to be recycled. The only problem? National Archives didn’t destroy the data on the disk before sending it out to its contractor. | Number of records affected: 76 million |
| Universal American Action Network | Universal Action Network, a subsidiary of Universal American Insurance, sent out postcards to 80,000 Universal clients earlier this month. The problem was that each of the cards included the Social Security numbers of the recipients. Identity theft anyone? Universal blamed the inclusion of the SSNs on a printing error and said it has terminated its contract with the printer. | Number of records affected: 80,000 |
Comments are closed.