[Dataloss] CPA group says hard drive with data on 330, 000 members missing

[security curmudgeon]

Courtesy WK/ISN:

---------- Forwarded message ----------

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9001030

By Jaikumar Vijayan
Computerworld
June 07, 2006

Adding to the lengthening list of organizations reporting data 
compromises, the American Institute of Certified Public Accountants 
(AICPA) today confirmed that a computer hard drive containing the 
unencrypted names, addresses and Social Security numbers of nearly all of 
its 330,000 members has been missing since February.

The hard drive had been accidentally damaged by an AICPA employee and was 
sent out for repair to an external data-recovery service in violation of 
the AICPA's policies, said Joel Allegretti, a spokesman for the New 
York-based organization. It was on its way back to the AICPA via FedEx but 
failed to arrive. Allegretti did not say when exactly the drive went 
missing except to note that the package containing it was due back at the 
AICPA "toward the end of February."

It took the organization until March 31 to "re-create the drive" and 
determine what data it contained. The AICPA began notifying affected 
members of the potential compromise of their personal data on May 8 and 
has since completed the task, Allegretti said.

Jim McClusky, a spokesman for FedEx Corp., said it is unclear what exactly 
happened to the drive. But he stressed that it is a mistake to 
characterize the package as being lost.

"We did handle the shipment, and we are working closely and cooperatively 
with our customer to determine where the package might be," he said. "It 
is still being investigated. At this point, we are looking at it as a 
missing shipment; that doesn't mean it's lost."

Based on investigations so far, it does not appear that information on the 
hard drive has been misused, Allegretti said.

Following the loss, the AICPA is offering affected members a year's worth 
of free credit-monitoring services. The incident has also prompted the 
group to begin deleting all Social Security numbers from its member 
database.

While a note posted on the organization's Web site says the collection of 
Social Security numbers has been a long-standing procedure, it added that 
"we will cease collecting and maintaining them, except in limited 
circumstances. And even for those, we are accelerating our efforts to 
develop other means of uniquely identifying our members."

News of the AICPA breach comes amid a flurry of similar disclosures in 
recent days. By far, the biggest was the May 22 disclosure by the U.S. 
Department of Veterans Affairs that it had lost personal data on more than 
26.5 million veterans discharged since 1975. Since then, the agency has 
admitted that the breach may have exposed personal information on about 
2.2 million active-duty National Guard and Reserve troops as well (see 
"Personal info on 2.2M troops part of VA data theft" [1]).

Since then, there have been similar disclosures elsewhere, including Texas 
Guaranteed Student Loan Corp., a Round Rock, Texas-based nonprofit 
organization. TG said that an outside contractor lost an unspecified piece 
of equipment containing the names and Social Security numbers of 
approximately 1.3 million borrowers.

On May 26, Sacred Heart University in Fairfield, Conn., announced that one 
of its computers had been hacked into, resulting in the potential 
compromise of data belonging to 135,000 alumni and would-be students. And 
earlier this month, a password-protected laptop containing credit card 
information on more than a quarter-million Hotels.com LP customers was 
stolen from the car of an auditor at Ernst & Young LLP.

[1] http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9000992