Arbella Mutual Insurance Co. of Quincy was offering unrestricted access to the Registry of Motor Vehicles database through its own website until a Salem man noticed the security breach and raised concerns about the potential for identity theft.
Joel P. McNamee, 22, said he received some paperwork from his insurance agent over the weekend and noticed a website address at the bottom of one of the pages. The website, www.arbella.com/RegistryAccess/entry, gave him access to the Registry of Motor vehicles database.
He said he was able to look up anyone by name and obtain their address, date of birth, license number, and driving history. In most cases, he said, he was also able to obtain the driver's Social Security number by looking at their historical records.
''Once you had the license number you could cross-reference it to get all sorts of different things," he said. He said the personal information contained on the database would be a treasure trove for identity thieves.
On Tuesday afternoon, Arbella took down its link to the Registry database and the Registry cut off the company's access after McNamee called Governor Mitt Romney's office and informed an aide there of the security breach. The aide called the state Division of Insurance, which in turn contacted Arbella.
Arbella spokesman James DiNatale said yesterday that Registry information is routinely used by company employees and agents for business purposes, but normally access to the data is password protected. He declined to explain how the company's website was reconfigured to allow access without a password.
''I currently don't want to talk about the security aspect of this," he said. He said the company was preparing a statement on the matter that would probably be released today.
DiNatale said the company believes the unrestricted access to the Registry database was a temporary phenomenon and personal driver information was obtained by a small group of outsiders between Sunday night and Tuesday afternoon. The outsiders included McNamee and a business associate, and reporters at the Globe who checked the website out after receiving a call from McNamee.
Chris Goetcheus, a spokesman for the state Division of Insurance, said state and federal laws require the Registry to provide access to its records to insurance companies and agents in the course of writing policies and servicing customers. He said contracts between the Registry and the insurers require the companies to keep personal information confidential.
State officials said Arbella will not gain access to Registry data until questions about this breach are cleared up. ''At this point, we're trying to understand how this could have occurred and obtain assurances that it won't happen again," Goetcheus said.
Officials at McNamee's insurance agency, Burke Insurance of Salem, did not return a phone call. Officials there apparently sent McNamee some Registry information on him. It was obtained using Arbella's link to the Registry even though McNamee was a client of OneBeacon Insurance. Many agents represent more than one insurance company.
A spokeswoman for OneBeacon said the company doesn't offer its agents a link to the Registry via the company's website.
DiNatale said Arbella will attempt to determine whose driving records were obtained improperly and notify those individuals.
McNamee said he looked up the records of Romney, ''Tonight Show" host Jay Leno, actors Matt Damon and Ben Affleck, and comedian Bill Cosby. Globe reporters checked out the records of Mayor Thomas M. Menino, Romney, and some Globe reporters and editors.
Boston Police Lieutenant Daniel Linskey said Arbella officials notified the mayor's office that the mayor's Registry information had been obtained improperly. He said he was also told that Registry information on some Boston city councilors had been accessed.