Back in November 2007, I uncovered a data breach containing about 7000 partial names, addresses and full SSNs of students that graduated from the public school system from which I graduated in 2002. The data was publicly posted on a website of a vendor that the school had used. Here is an example line from the leak:<br>
<table width="1026" align="BLEEDLEFT" border="0" cellpadding="0" cellspacing="0"><tbody><tr valign="top"></tr><tr valign="top"><td colspan="3" width="30"><br></td>
<td colspan="7" rowspan="2" width="92"><font size="2" face="Arial"><b><u>Permanent Number</u></b></font></td>
<td colspan="4" width="40"><br></td>
<td colspan="3" rowspan="2" width="53"><font size="2" face="Arial"><b><u>LAST NAME</u></b></font></td>
<td colspan="2" width="20"><br></td>
<td colspan="4" rowspan="2" width="51"><table cellspacing="0">
<tbody><tr>
<td align="left"><font size="2" face="Arial"><b><u>FIRST </u></b></font></td>
</tr>
<tr>
<td align="left"><font size="2" face="Arial"><b><u>NAME </u></b></font></td>
</tr>
</tbody></table>
</td>
<td colspan="11" width="216"><br></td>
<td colspan="5" rowspan="2" width="79"><font size="2" face="Arial"><b><u>Geocode Status</u></b></font></td>
</tr>
<tr valign="top">
<td colspan="17" width="335"><br></td>
<td colspan="4" width="40"><br></td>
<td colspan="2" width="20"><br></td>
<td colspan="5" width="62"><br></td>
<td width="64"><font size="2" face="Arial"><b><u>Address</u></b></font></td>
<td colspan="3" width="58"><br></td>
<td colspan="4" width="61"><font size="2" face="Arial"><b><u>ZIP</u></b></font></td>
<td width="11"><br></td>
<td colspan="3" width="59"><font size="2" face="Arial"><b><u>GRADE</u></b></font></td>
</tr>
<tr valign="top">
<td colspan="62" width="1006"><br></td>
</tr>
<tr valign="top">
<td colspan="16" width="325"><br></td>
<td colspan="12" width="142"><font size="2" face="Arial">401999999</font></td>
<td colspan="6" width="84"><font size="2" face="Arial">XXXXX</font></td>
<td colspan="6" width="74"><font size="2" face="Arial">......hia</font></td>
<td colspan="5" width="140"><font size="2" face="Arial">.......estown Rd</font></td>
<td width="10"><br></td>
<td colspan="3" width="48"><font size="2" face="Arial">40511</font></td>
<td colspan="2" width="26"><br></td>
<td width="25"><font size="2" face="Arial">D</font></td>
<td colspan="4" width="54"><br></td>
<td width="28"><font size="2" face="Arial">09</font></td></tr></tbody></table><br>Note that I changed the social security number to protect the innocent, but everything else is the same. As you can see, the data provided was full social, last three letters of the first name, partial address, full zip, the high school the student was attending in the year 2001, and the grade they were in when they attended that school. I notified both the vendor and the school district and they removed the information. They told me they would not notify the affected individuals because the amount of information contained in the leak was so small that it was useless to any potential ID theif.<br>
<br>However, because the breach targets such a small group of individuals I was easily able to go through the information and using publicly available information fill in a lot of missing information and obtain full SSN, name, addresses, and phone numbers. I have also notified the FCC and attempted to contact other agencies, but no one seems to really care that this data loss has occurred. Now, several months later, I have found out that I am a victim of identity theft (someone filed taxes under my SSN). While there is no way to link these two incidents, it has caused me to look back into this data leak I discovered back in Nov.<br>
<br>So, my question to the list is what is the best way and to whom do you report a data loss event that neither of the responsible parties are willing to disclose?<br><br>Or, am I just being too paranoid and the amount of data that was leaked should not be a cause for concern?<br>