[ISN] Personal data on hundreds of Americans faxed to Manitoba company

[InfoSec News]

http://www.theglobeandmail.com/servlet/story/RTGAM.20060205.wdata0205/BNStory/National/home

STEVE LAMBERT 
Canadian Press
05/02/06 

Lockport, Manitoba - Confidential information on hundreds of United 
States citizens, including social security numbers, health information 
and bank account numbers, is being sent mistakenly by fax to a small 
Manitoba company.

A 60-centimetre-high stack of data, which also includes people's 
addresses and salaries, already sits in the offices of North Regent 
Rx, a herbal remedy distribution company that operates out of a house 
in Lockport, 15 kilometres north of Winnipeg.

"I know how much these people make, I know what their social security 
number is, I know where they live," North Regent Rx spokesman Jody 
Baxmeyer told The Canadian Press.

"Almost everything a person needs for identity theft is actually faxed 
to us on a daily basis."

Far from using the information for any illicit purposes, Ms. Baxmeyer 
says his company has been trying to stop the faxes from coming in, but 
has been unable to reach an agreement with Prudential Financial, the 
U.S.-based company that is the intended recipient.

The problem started as soon as North Regent Rx began operating 15 
months ago. The company's toll-free fax number is almost identical to 
the number used by Prudential's insurance division, which receives 
faxes from doctors' offices about medical benefits given to patients 
with Prudential insurance.

Employees at many doctors' offices have dialled the wrong number, 
sending the information to North Regent Rx.

The pile in Ms. Baxmeyer's office reveals data about people in many 
states - a Maryland woman with thyroid trouble, a Massachusetts man 
suffering from depression, and Kelly McDonough, 43, an Ohio woman who 
has lost her sight because of diabetes.

"That bothers me," McDonough said from her home in Columbus.

"I do not appreciate the fact that my social security number is in the 
hands of someone I don't know. I know that there can be identity theft 
with as little information as a social security number."

McDonough said the mixup has affected her financially, because she 
initially didn't get reimbursed for the claim that was mistakenly 
faxed to North Regent Rx. After waiting for a few weeks, she assumed 
Prudential might have lost the information and had her doctor's office 
resend the fax, which reached the right destination on the second try.

Prudential says it's trying to address the situation.

"As soon as we learned that disability forms were being misdirected 
due to dialer error, Prudential Financial offered to work with North 
Regent Rx to resolve the matter," the company said in a written 
statement.

"We have asked the six medical providers that we are aware of that 
have misdialled to be more careful when dialing."

Last August, Prudential vice-president Patrick O'Toole wrote to Ms. 
Baxmeyer to suggest that North Regent Rx send Prudential the faxes 
they have been receiving.

Ms. Baxmeyer says North Regent has forwarded some faxes to Prudential, 
and has often faxed messages to the clinics to tell them they have 
misdialled.

But he said it's a time-consuming task for a small company. And the 
ongoing problem has tied up the fax line, he said, preventing North 
Regent customers from sending in their orders.

"The (solution) from our point of view is pretty simple — buy our 
toll-free number," Ms. Baxmeyer said.

"It would take care of the problem right there."

Ms. Baxmeyer said North Regent Rx has approached Prudential about 
selling the fax number, but the insurance firm has not yet agreed.

North Regent Rx would want to be compensated for the cost of changing 
its toll-free number on advertising and invoices, as well as for fees 
charged by the telephone company, he said.

Prudential's written statement says the company is "eager to continue 
to work with North Regent Rx to resolve the issue."

This is not the first time personal data has been sent over the 
Canada-U.S. border to the wrong recipient.

In November of 2004, The Globe and Mail and CTV reported that between 
2001 and 2004, confidential information about hundreds of Canadian 
Imperial Bank of Commerce customers was faxed to a scrapyard in West 
Virginia.

The scrapyard's owner, Wade Peer, said the volume of faxes prevented 
him from communicating with his customers and forced him to close one 
of his businesses.