Slashdot Log In
UK Bank Laptop Stolen With 11M Customer Records
Posted by
CowboyNeal
on Sat Nov 18, 2006 10:33 AM
from the easy-come-easy-go dept.
from the easy-come-easy-go dept.
daveewart writes "BBC News reports that the UK Building Society Nationwide has admitted that a laptop containing account records of more than 11 million customers has been stolen from an employee's home. This story raises a number of worrying questions: The theft happened three months ago, why has the news only just been made public? Why was it possible (indeed, why was it necessary at all) to put data relating to their entire customer base on an employee's laptop stored at an employee's home? Why was the information on the laptop not encrypted?"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
worrying questions (Score:5, Insightful)
The worrying questions should be
Why should anyone be able to ruin your finances by just knowing some numbers?
Why should someone be able to borrow in your name by just quoting some number?
Why is my future dependent on whether some data entry operator in some company follows the proper security precautions?
I hate how everyone is using the term 'identity theft'. No one can steal someone else's identity (for now anyway).
What 'identity theft' really means is that the the methods the financial industry uses to identify people is broken.Whenever the govt holds hearing on 'identity theft' they are only legitimizing these methods and making the people responsible for the failures of the financial industry.
Re: (Score:2, Insightful)
Anyway the parent is right on the money, but we could start by taking easy b
Re: (Score:3, Insightful)
Right. It's interesting to see how, in the USA, where (more) people are (
Re: (Score:2, Interesting)
Re: (Score:2)
say 500 bytes per record - plenty to store name, address, phone number, account number, balance, ID number.
11M * 500 = 5500MB or about 5.5 GB. There's still plenty of room.
Re: (Score:2)
Re: (Score:2)
Ok, consider this. Let's assume that each record is, say, a couple of kilobytes (that's much more than it probably is) of just text, as you say.
11,000,000 * 2kb = 22,000,000 kbytes.
22,000,000Kb = 21484.375 MB = 20.98 GB.
If it's in a raw database format, that is.
Last time I checked, laptops aren't exactly being sold with 20GB of HD space.
Re:worrying questions (Score:5, Insightful)
One of the databases I was working on had hundreds of thousands of credit card numbers in it. I deleted it, of course, but it was trivial to bring it home... at that time, to me, it wasn't a collection of credit card numbers, it was just "the database I needed to have present to finish my work".
It's SOO easy to be trivial about these types of things when you're an overworked IT pro. Security procedures exist BECAUSE it's so easy to forget that the stuff that you deal with in such a routine fashion is sensitive. It's just like reality tv stars forgetting about the cameras.
Parent
Re: (Score:3, Interesting)
I can understand, though, how some smaller companies may not have the resources to do things like this properly, but for the benefit of other read
Re: (Score:3, Funny)
The idea of not using "live data" in that particular case was a bit of a joke.
What they're doing is breaking the law. (Score:5, Insightful)
From the UK Data Protection Act 1998.
If this hasn't been followed then the law has been broken and the perpetrators should suffer the consequences. Which is currently a fine of up to £5,000 per offence. Directors being liable. With potentially 11 million offences that could add up to a lot of money.
Parent
Re: (Score:2, Funny)
Re: (Score:2)
Why should anyone be able to ruin your finances by just knowing some numbers?
Because otherwise you would not be able to use all these nifty on-line things, and would need to go to the bank everytime you wanted to transfer money. The problem is not in the use of numbers, but in recklessness.
Re:worrying questions (Score:4, Informative)
If people could actually claim ownership of their data and have it released only when they specifically agreed to the release with proper notification, the identity theft problems would go away (but so would the business model of the credit agencies).
Parent
Re:worrying questions (Score:4, Insightful)
Excellent question.
One big problem is that in the U.S., at least, we've generally conflated identification with authentication. But they're two very different problems.
If, for example, Social Security numbers were only ever used for identification -- telling two different John Smiths apart, for example -- it wouldn't matter if they were public. In fact I've heard that one of the Scandanavian countries publishes a freely-available database of everyone's identification numbers. Besides being convenient, this ensures that nobody ever sets up a scheme that stupidly uses an identification number as an authenticator.
The big problems arise when the same number that's widely used for identification -- e.g. a SSN -- is also used for authentication.
It wouldn't be so bad if all it took to pove to my bank that I'm me was a number or word, as long as that number or word is secret, and only used for that purpose, so that it has a decent chance of staying secret.
Parent
Re: (Score:3, Informative)
[1] - Everyone who's been issued an ID Card; that is, about 90% of the population.
Why was the info. on the laptop not encrypted? (Score:5, Insightful)
That is the one question that doesn't step on internal business processes, data, or procedures.
With free "hard" encryption tools out there such as TrueCrypt and encfs, there is no excuse whatsoever for customer data to leave the data center without an encryption envelope/container.
Re: (Score:3, Insightful)
When did stupidity stop being a valid reason?
Re: (Score:2)
I know a few companies (although really small) which have the same mentality. One is a photographer who uses a laptop without a firewall, IE6, without antivirus and without any updates. They say that they don't need any updates or nothing because he only uses the laptop to check emails and go on eBay. Sigh.
Why, why, why? (Score:4, Funny)
It is not often I say . . . (Score:4, Funny)
Re: (Score:3, Funny)
Or is that *had* in your account?
a reason to SMILE (Score:4, Interesting)
It amazes me that people still use high street banks. I haven't set foot in a bank in 5 years.
Re: (Score:2, Interesting)
Seems like you're nothing but a petty shill.
Re: (Score:2)
Pathetic.
Re: (Score:2, Insightful)
And hey - how many other banks have two rabid fans that are prep
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Sounds like they should be prosecuted (Score:3, Insightful)
Re: (Score:2)
Banking competition... (Score:2)
Re: (Score:3, Informative)
Suck it up (Score:4, Interesting)
However, we all carry on using their services because we're stuffed if we don't - if your university loses your details, what are you going to do? quit? if your morgage is with your bank and they lose your account information, are you going to change bank?
Because there is basically, when all is said and done, no *real* pain for organisations, for loosing information, there is no *real* need for them to understand security enough for these data losses to stop.
So suck it up!
Personally, I'm trying to get out from under. I gave up my mobile phone last week - I do not accept having my mobile phone calls logged for a year. I'm moving over to Tor, because I do not accept having my browsing logged for four days (current UK retention). I'm thinking about getting rid of the phone, too, and moving over purely to encrypted email which will be sent/receieved from my own home-run POP/SMTP server.
Re:Suck it up (Score:4, Insightful)
When the customers have low bargaining power due to a natural oligopoly market scenario with few large, powerful competitors, the government needs to provide some protections from this sort of abusive behavior.
Parent
Re: (Score:2)
Unfortunately, the State is not independent of these corporations - their lobbies are effective and well funded. In other words, the mechanism which we, as individuals, have collectively agreeded to bring into existance (the State) is not functioning; it has been compromised by the entities it was created to constrain.
There *is* a penalty (Score:2)
Not a Huge Surprise (Score:5, Insightful)
People are asking various questions like "Why wasn't it encrypted?" That's a pointless question. I want to know how on Earth you get 11 million customer records on to a single laptop in the first place.
It's not that unusual at all sadly. All customer details are stored on mainframes or in big databases centrally, so no, there's no chance of stealing everything to do with a customer. This is where the disorganisation of UK banks' IT systems comes in handy. I'm wondering if this is perhaps a dirty great Access database or something used for mailing list or money laundering (ironic, I know) purposes. If so, this kind of thing happens all the time.
Utter tosh (Score:4, Informative)
Ah, the 'I know everything better than you do' type of genius. Tell us, oh great one, of how your towering intellect dwarfs the mere minnows you have dealt with in the past.
I too have contracted around various UK and foreign-owned but UK-based banks. Some of the people I met there were fools. Some were amongst the brightest people I've known. As ever, and particularly in organisations that huge, there's a large mix of people involved. There are also a number of bright people in banks who's area of expertise isn't computing - they're banks remember?
There may well be an issue of education, and also I'd like to know why these things didn't have full-drive encryption installed. Then again, we don't know that it didn't - despite the article summary, Nationwide have refused to give any details. That's any details, whether positive or negative, nor have they confirmed any numbers. 11 million is just the number of customers they have, not necessarily the ones on the laptop.
Cheers,
Ian
Parent
well its a good thing they don't..... (Score:3, Insightful)
Oh wait, Did I say "don't"?
why? why? why? (Score:2)
Probably not enough ID.. (Score:2)
TFA (Score:3, Informative)
More infomation
http://www.nationwide.co.uk/security/news_and_ale
This was a domestic burglary, there's a chance that the theif has no idea this laptop was special, and has already sold it cash in hand down the pub. It's probably being used right now by someone browsing for porn or doing 'ebay' unaware of what sits of that disk.
Not to say they should not presume the worse and react accordingly of course.
why was it even there? (Score:2, Interesting)
How many of this business's employees have full access to the entire customer database with account numbers?
Is it company policy to allow empoyees to take business records home at all? Or for that matter, is it even within company policy to bring your own personal laptop into the building?
So, what policies were broken, what policies are being changed, and what's not go
UK banking laws will protect customers, but... (Score:2)
Someone takes out a loan with your bank account details. Problem is discovered. You waste time and effort fixing it. Bank and loan company waste time. Loan amount is lost to criminal. Loss results in higher rates and charges for everyone. Who will pick up the bill? Not the bank,
Profit!! (Score:3, Interesting)
2. Write letter to bank, complaining that all money was stolen, and demanding compensation. The bank can't refute your claim, because your authentication data has been stolen, so they can never prove it was _really_ you who did the withdrawal.
3. Profit!!!
Re: (Score:2)
Re: (Score:3, Insightful)
Nahh, just 1 day in jail for the directors of the company, for each individual's information that was stolen.
See you in 11000000/365 = about 30,000 years!!!
The directors *are* liable to a fine (Score:2)
Re: (Score:2)
m - milli = 0.001
k - kilo = 1 000
M - mega = 1 000 000
I consider local namings/conventions a sort of slang that should not be used in a global forum.