<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=windows-1250">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Garamond;
panose-1:2 2 4 4 3 3 1 1 8 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Depending on the state laws governing this incident, the school
and the vendor don’t have the option of not notifying the “potential” victims.
Data loss is data loss.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>I’d start with the State Attorneys office. I believe they have
jurisdiction of that.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Garamond","serif";
color:#4F81BD'>Thomas J. Raef<o:p></o:p></span></b></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Garamond","serif";
color:#4F81BD'>e-Based Security, LLC<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Garamond","serif";
color:#4F81BD'>http://www.ebasedsecurity.com<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Garamond","serif";
color:#4F81BD'>traef@ebasedsecurity.com<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Garamond","serif";
color:#4F81BD'>1-888-251-5803<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>
dataloss-bounces@attrition.org [mailto:dataloss-bounces@attrition.org] <b>On
Behalf Of </b>Aaron Allen<br>
<b>Sent:</b> Saturday, May 03, 2008 11:11 AM<br>
<b>To:</b> dataloss@attrition.org<br>
<b>Subject:</b> [Dataloss] Reporting Dataloss<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Back in November 2007, I uncovered a data breach containing
about 7000 partial names, addresses and full SSNs of students that graduated
from the public school system from which I graduated in 2002. The data
was publicly posted on a website of a vendor that the school had used.
Here is an example line from the leak:<o:p></o:p></p>
<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 width=1026
style='width:769.5pt'>
<tr>
<td style='padding:0in 0in 0in 0in'></td>
<td style='border:none;padding:0in 0in 0in 0in' width=1300 colspan=24><p class='MsoNormal'> </td>
</tr>
<tr>
<td width=30 valign=top style='width:22.5pt;padding:0in 0in 0in 0in'></td>
<td width=92 rowspan=2 valign=top style='width:69.0pt;padding:0in 0in 0in 0in'>
<p class=MsoNormal><b><u><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Permanent
Number</span></u></b><o:p></o:p></p>
</td>
<td width=40 valign=top style='width:30.0pt;padding:0in 0in 0in 0in'></td>
<td width=53 rowspan=2 valign=top style='width:39.75pt;padding:0in 0in 0in 0in'>
<p class=MsoNormal><b><u><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>LAST
NAME</span></u></b><o:p></o:p></p>
</td>
<td width=20 valign=top style='width:15.0pt;padding:0in 0in 0in 0in'></td>
<td width=51 rowspan=2 valign=top style='width:38.25pt;padding:0in 0in 0in 0in'>
<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0>
<tr>
<td style='padding:.75pt .75pt .75pt .75pt'>
<p class=MsoNormal><b><u><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>FIRST
</span></u></b><o:p></o:p></p>
</td>
</tr>
<tr>
<td style='padding:.75pt .75pt .75pt .75pt'>
<p class=MsoNormal><b><u><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>NAME
</span></u></b><o:p></o:p></p>
</td>
</tr>
</table>
</td>
<td width=216 colspan=4 valign=top style='width:2.25in;padding:0in 0in 0in 0in'></td>
<td width=79 rowspan=2 valign=top style='width:59.25pt;padding:0in 0in 0in 0in'>
<p class=MsoNormal><b><u><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Geocode
Status</span></u></b><o:p></o:p></p>
</td>
<td style='border:none;padding:0in 0in 0in 0in' width=540 colspan=14><p class='MsoNormal'> </td>
</tr>
<tr>
<td width=335 valign=top style='width:251.25pt;padding:0in 0in 0in 0in'></td>
<td width=40 valign=top style='width:30.0pt;padding:0in 0in 0in 0in'></td>
<td width=20 valign=top style='width:15.0pt;padding:0in 0in 0in 0in'></td>
<td width=62 valign=top style='width:46.5pt;padding:0in 0in 0in 0in'></td>
<td width=64 valign=top style='width:48.0pt;padding:0in 0in 0in 0in'>
<p class=MsoNormal><b><u><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Address</span></u></b><o:p></o:p></p>
</td>
<td width=58 valign=top style='width:43.5pt;padding:0in 0in 0in 0in'></td>
<td width=61 valign=top style='width:45.75pt;padding:0in 0in 0in 0in'>
<p class=MsoNormal><b><u><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>ZIP</span></u></b><o:p></o:p></p>
</td>
<td width=11 valign=top style='width:8.25pt;padding:0in 0in 0in 0in'></td>
<td width=59 colspan=2 valign=top style='width:44.25pt;padding:0in 0in 0in 0in'>
<p class=MsoNormal><b><u><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>GRADE</span></u></b><o:p></o:p></p>
</td>
<td style='border:none;padding:0in 0in 0in 0in' width=380 colspan=10><p class='MsoNormal'> </td>
</tr>
<tr>
<td width=1006 colspan=25 valign=top style='width:754.5pt;padding:0in 0in 0in 0in'></td>
</tr>
<tr>
<td width=325 colspan=3 valign=top style='width:243.75pt;padding:0in 0in 0in 0in'></td>
<td width=142 colspan=4 valign=top style='width:106.5pt;padding:0in 0in 0in 0in'>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>401999999</span><o:p></o:p></p>
</td>
<td width=84 colspan=3 valign=top style='width:63.0pt;padding:0in 0in 0in 0in'>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>XXXXX</span><o:p></o:p></p>
</td>
<td width=74 valign=top style='width:55.5pt;padding:0in 0in 0in 0in'>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>......hia</span><o:p></o:p></p>
</td>
<td width=140 colspan=3 valign=top style='width:105.0pt;padding:0in 0in 0in 0in'>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>.......estown
Rd</span><o:p></o:p></p>
</td>
<td width=10 valign=top style='width:7.5pt;padding:0in 0in 0in 0in'></td>
<td width=48 valign=top style='width:.5in;padding:0in 0in 0in 0in'>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>40511</span><o:p></o:p></p>
</td>
<td width=26 valign=top style='width:19.5pt;padding:0in 0in 0in 0in'></td>
<td width=25 valign=top style='width:18.75pt;padding:0in 0in 0in 0in'>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>D</span><o:p></o:p></p>
</td>
<td width=54 valign=top style='width:40.5pt;padding:0in 0in 0in 0in'></td>
<td width=28 valign=top style='width:21.0pt;padding:0in 0in 0in 0in'>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>09</span><o:p></o:p></p>
</td>
<td valign=top style='padding:0in 0in 0in 0in'></td>
<td valign=top style='padding:0in 0in 0in 0in'></td>
<td valign=top style='padding:0in 0in 0in 0in'></td>
<td valign=top style='padding:0in 0in 0in 0in'></td>
<td valign=top style='padding:0in 0in 0in 0in'></td>
</tr>
<tr height=0>
<td width=251 style='border:none'></td>
<td width=86 style='border:none'></td>
<td width=30 style='border:none'></td>
<td width=49 style='border:none'></td>
<td width=30 style='border:none'></td>
<td width=48 style='border:none'></td>
<td width=15 style='border:none'></td>
<td width=47 style='border:none'></td>
<td width=61 style='border:none'></td>
<td width=53 style='border:none'></td>
<td width=73 style='border:none'></td>
<td width=52 style='border:none'></td>
<td width=9 style='border:none'></td>
<td width=62 style='border:none'></td>
<td width=8 style='border:none'></td>
<td width=45 style='border:none'></td>
<td width=20 style='border:none'></td>
<td width=21 style='border:none'></td>
<td width=41 style='border:none'></td>
<td width=24 style='border:none'></td>
<td width=0 style='border:none'></td>
<td width=0 style='border:none'></td>
<td width=0 style='border:none'></td>
<td width=0 style='border:none'></td>
<td width=0 style='border:none'></td>
</tr>
</table>
<p class=MsoNormal style='margin-bottom:12.0pt'><br>
Note that I changed the social security number to protect the innocent, but
everything else is the same. As you can see, the data provided was full
social, last three letters of the first name, partial address, full zip, the
high school the student was attending in the year 2001, and the grade they were
in when they attended that school. I notified both the vendor and the
school district and they removed the information. They told me they would
not notify the affected individuals because the amount of information contained
in the leak was so small that it was useless to any potential ID theif.<br>
<br>
However, because the breach targets such a small group of individuals I was
easily able to go through the information and using publicly available
information fill in a lot of missing information and obtain full SSN, name,
addresses, and phone numbers. I have also notified the FCC and attempted
to contact other agencies, but no one seems to really care that this data loss
has occurred. Now, several months later, I have found out that I am a
victim of identity theft (someone filed taxes under my SSN). While there
is no way to link these two incidents, it has caused me to look back into this
data leak I discovered back in Nov.<br>
<br>
So, my question to the list is what is the best way and to whom do you report a
data loss event that neither of the responsible parties are willing to
disclose?<br>
<br>
Or, am I just being too paranoid and the amount of data that was leaked should
not be a cause for concern?<o:p></o:p></p>
<p><span style='font-size:10.0pt'>No virus found in this incoming message.<br>
Checked by AVG.<br>
Version: 7.5.524 / Virus Database: 269.23.8/1412 - Release Date: 5/2/2008 4:34
PM</span><o:p></o:p></p>
</div>
</div>
</body>
</html>
<BR>
<P><FONT SIZE=2>No virus found in this outgoing message.<BR>
Checked by AVG.<BR>
Version: 7.5.524 / Virus Database: 269.23.8/1412 - Release Date: 5/2/2008 4:34 PM<BR>
</FONT> </P>