[Dataloss] Marsh Inc. loses computer with claims data on more than 500K NYers, including DOB, SSN, address

[Chris Walsh]

Software firm loses computer loaded with personal details of about  
500K in NY
By JOHN RILEY
Newsday Staff Writer

July 21, 2006, 8:52 PM EDT

More than a half-million New Yorkers who have made claims to a  
special workers' compensation fund have been notified that a Chicago- 
based claims-management software firm has lost track of a personal  
computer containing their private data, including Social Security  
numbers.

The company, CS Stars, a subsidiary of insurance giant Marsh Inc.,  
lost track of the computer while installing claims-management  
software for the Special Funds Conservation Committee, a private  
insurer-and-employer group that handles two particular types of  
workers' comp claims under New York State law.

The company has called in the FBI to investigate the May 9  
disappearance of the computer, and in a letter dated July 18 promised  
New Yorkers whose data were lost that it would provide free credit  
monitoring for the next year to nip any possible identity theft in  
the bud, and $25,000 in identity-theft insurance.

"We're working to recover the data and protect all the people whose  
data is missing," said Al Modugno, a company spokesman. He said there  
was no indication, to date, that anyone had misused data from the  
missing computer.

The Special Funds Conservation Committee handles workers'  
compensation coverage in New York for about 56,500 disabled workers  
who suffer a second injury, and about 36,000 old claims that are  
reopened. In existence since 1938, it maintains records on about  
540,000 old and current claimants, said chief executive Steven Licht.

"Obviously, we're not thrilled with this situation," Licht said.

"You always see stories about identity theft," said one Long Islander  
who got a letter from CS Stars, but asked that his name not be  
disclosed. "People can play with your name and get loans under your  
name, so obviously we're worried about that."

All the names in the database, Licht said, had address, date of birth  
and Social Security number attached, and some also would have  
employer and accident information, but none had confidential medical  
records included. Licht also said there were copies of all the data,  
and claims payments had not been interrupted.

Modugno said an employee at CS Stars' headquarters first realized  
that the computer containing New Yorkers' private data was missing on  
May 9. The employee, he said, did not notify management until June 19.

Management was "appalled" by the delay, Modugno said, and initiated  
an investigation by another Marsh subsidiary, the security firm Kroll  
Inc., on June 23. It let Licht's group know their data had been lost  
on June 29, and notified the FBI on June 30.

The company still has no idea what happened to the computer. "The  
facility is protected by key-card access, on-site personnel, and has  
cameras," Modugno said.

[http://www.newsday.com/ny-uscomp0722,0,4389008.story?coll=ny-top- 
headlines]