Bank Of America Loses 1.2 Million Customer Records 299
Christopher Reimer writes "C|Net is reporting that Bank of America lost 1.2 million customer records when some backup tapes went missing while being shipped to a backup center. The lost records mainly effect U.S. government employees involved in the SmartPay program. From the article: 'The acknowledgment comes as several other cases of businesses losing consumer information have come to light.'"
heh (Score:5, Funny)
Doesn't sound so smart right now...
Indeed. (Score:3, Interesting)
Well, I guess they have at most 999,999,999 more transactions until we know that they've blown their *ahem*commitment to their consumers--unless you count each person affected as an error here, in which case we can probably sue them for false advertising. Or at least utter stupidity.
That said, I bet someone mixed those backup tapes in the
Well.. (Score:5, Informative)
Re:Well.. (Score:2)
My question is, why the conflict of interest, requiring all employees to use a single credit card provider?
Why cannot this bogus thinking be applied such that everyone has to use the same bank, in addition to credit card provider?
In defense of the policy, you get that swell logo that tells the airline or hotel to give you the government rate. Whoopee. Why can't other credentials suffice
Re:Well.. (Score:2)
Historically, I believe the government issued cards to employees, who partied like rock stars, and then defaulted. Putting the actual employees name on the card was supposed to increase accountability. Of government employees. Oh, wait...
Re:Well.. (Score:2)
Re:Well.. (Score:3, Insightful)
Then they might just get a freakin clue.
Re:Well.. (Score:4, Insightful)
Re:Well.. (Score:2)
pick a better bank = no
Be more picky with your requests.
Re:Well.. (Score:5, Informative)
I will not use them in any form. I will drive 10 miles out of the way to NOT use even their ATM machines. (No they ain't even getting my $1.50 for a transaction.
BoA and getting screwed.... (Score:3, Interesting)
I view my banks as necessary evils, and little more. I have my primary checking account with U.S. Bank right now, and for a while, thought they were going to be "above average". They offer free, unlimited online billpay, for example - while many others want to charge
Re:Well.. (Score:2)
Re:Well.. (Score:2, Informative)
Re:Well.. (Score:3, Informative)
Re:Well.. (Score:2)
A German bnk would happily let you bank dollars, but you pay a lot for the handling of dollar cash.
Re:Well.. (Score:3, Funny)
Re:Well.. (Score:2)
You'll probably be drafted to the military and then BoA will lose all your stuff too
So? (Score:2, Insightful)
Re:So? (Score:2)
Well... (Score:5, Insightful)
Now, I generally frown on lawsuits, but this is one type of case where it works. The people on these lists need to start filing class action lawsuits against these companies. Large corporations only feel something when they lose money, maybe it would send the message that you will be held accountable if you do not take security seriously.
As we all know, nothing is as valuable as our information.
Re:Well... (Score:5, Insightful)
You're hearing about this because of the flap about CheckPoint, and you heard about CheckPoint because of the current flap about identity theft.
If not for those circumstances, these stories would very likely have been reported in the business press, but otherwise below the general public's radar.
So, you have no reason to assume that the first appearance of an event on TV or in Slashdot means it never happened before.
BofA ought, of course, be held responsible for their behavior. I don't know if these cardholders can sue, since the card's were issued to them in conjunction with their federal employment. And, unless they are able to document loss as a result of the loss, I'm not sure what grounds they'd have for a suit.
That said, BofA just dug itself a big hole for the next contract recompete. Their accountablity may come in the form of losing that recompete. (Don't imagine, though, that a contract of that size will be given to some local mom-and-pop bank.)
Re:Well... (Score:4, Insightful)
Re:Well... (Score:2)
Phrases Like "could easily have been swept under the rug" imply a deliberate conspiracy to block the flow of news. The primary reason stories aren't reported in the general press is because editors and reporters think not enough people are interested.
Re:Well... (Score:2)
And, unless they are able to document loss as a result of the loss...
Well that shouldn't be too hard ;)
Re:Well... (Score:2)
My point about lawsuits applied to BofA, not CheckPoint. But, in either case, what, precisely, would someone be able to point to as the basis for the suit? I'm sure someone can sue for financial loss resulting from identity theft stemming from the CheckPoint/BofA data loss, but I'm not sure someone could sue for potential loss if, in fact, they weren't a victim of identity theft and if they did not, in fact, suffer any financial loss.
N
Re:Well... (Score:2)
He suggested the news was "swept under the rug", which very much implies he assumed that the general press was in league with Evil Corporations to suppress this bit of news. I don't. My assumption is that data theft prior to the recent publicity about identity theft would have been covered by the specialist media, not the general media.
Re:Well... (Score:2)
If these guys knew about the loss before CheckPoint informed the victims, and if they used that knowledge to manipulate CheckPoint stock, they ought to be prosecuted.
They certainly deserve to be fired simply because of the data loss, though. That's up to the people who own CheckPoint.
Re:Well... (Score:2)
Re:Well... (Score:3, Insightful)
Re:Well... (Score:4, Informative)
Sad but true.
Re:Well... (Score:5, Informative)
If law suits start being filed there will be a sudden demand to get these systems more secure. It's always annoyed me that financial companies have charged us for their "credit protection" services. I have always felt that if my ID was stolen it would most likely be the fault of a financial institution and not me.
Re:Well... (Score:2)
The great Republican defenders of the people just made it much more difficult to file a class action. It'll go to federal court and get dismissed quietly a few months down the road.
Class action lawsuits in limbo... (Score:2)
recent successful attempt to limit the venue
and the damages for any future class action
lawsuits - the Tort Reform Act was just signed
into law.
Isn't it just amazing that mere days after this
legislation passes:
(1) CheckPoint reveals 150 million users
information has been compromised,
(2) Microsoft accepts $5.00/incident liability
for their bugs causing data loss, and
(3) Bank of America loses backup tapes that
compromises 1.2 million (+)
Re:Well... (Score:2, Insightful)
According to the 2004 FBI/CSI Computer Crime and Security Survey, 53% of polled corporations, government agencies, financial institutions, medical institutions, and universities detected computer security breaches within the last twelve months.
To speak as if network security is some simple line item an organization would check-off and pay if they "cared" about their customers is utterly ignorant. Yes, there are thousands more
Re:Well... (Score:2)
Self-regulation? Might as well disband the police, hoping all those criminals will "self-regulate" themselves.
Re:Well... (Score:2)
Bullshit. The best solution is to threaten the CEO with jail time. That really stirs things up.
Encryption? (Score:5, Insightful)
Re:Encryption? (Score:2, Interesting)
Re:Encryption? (Score:2)
I think the decision not to encrypt backups is normally motivated by the hassle it would cause. When you lose the keys, the encryption is worthless. When the same keys are used every time, it is also almost worthless. So encryption causes extra work, to manage and securely store the keys.
The actual encryption of course isn't a problem.
Re:Encryption? (Score:2)
Their solutions use different architectural approaches, and are all generally straightforward to administer, but businesses are slow to purchase them because of potential compatibility problems, and also because it is often difficult to build ROI cases for security.
Kasten Chase [kastenchase.com]
Decru [decru.com]
Neoscale [neoscale.com]
Vormetric [vormetric.com]
(Disclaimer: I am employed by one of th
Re:Encryption? (Score:2)
And an ASIC would be faster.
Re:Encryption? (Score:2)
Re:Encryption? (Score:4, Insightful)
Re:Encryption? (Score:4, Interesting)
Bank record transportation is (or at least was, before Check21 went into effect) a major and rather vertical industry. The general chain of command is that a courier service picks up "the goods" (cancelled checks, backup tapes, whatever) from a bank, takes the cargo to the nearest airport, and drops it off in one manner or another. Depending on the bank and the courier, the goods are either dropped at the airport Post Office or taken to an airline's cargo input on the ramp.
From there, the obvious happens. Either the items are transported via USPS to their destination, or they fly as commercial cargo and wind up at the destination airport, where another series of couriers collects and delivers it to the receiving location. The article that I saw claimed that BOFA declined to describe how the process works. Well, this is how the process works.
The thing is, bank records are not exactly labeled "PERSONAL FINANCIAL RECORD BACKUPS, TOTALLY SECRET, PLEASE BE CAREFUL." The people who are working as couriers for banks know what they're picking up, but they also know that they're constantly under scrutiny. Once this stuff hits the ramp, it's just cargo as far as airline employees are concerned. It gets on a plane, flies to a destination, and things reverse; ramp agents unload random cargo as far as they know, and then some courier who knows damn well that he's being watched takes it to the receiving bank.
From all accounts, BOFA seems to be blaming ramp agents. I call bullshit. For one thing, nobody goes on or off a ramp without some sort of security check; I should know, I'm on the ramp almost every day. And most of the "secure" cargo flowing through a given ramp is unmarked and can't readily be recognized. The only time you pick up on something "special" is when Customs imounds a shipment.
As far as the explanations I've heard, I say BOFA are full of shit. This wasn't a ramp worker nabbing a case of backup tapes - he'd never have gotten off the ramp. This is negligence one way or another.
Re:Encryption? (Score:2, Informative)
Now, if they didn't encrypt their data, and that can be proven, THAT is grounds for a class-action from all of these victims.
I wonder how long ago they found out about this? (Score:5, Interesting)
ChoicePoint execs sold shares before theft news
ChoicePoint Inc.'s top two executives made a combined $16.6 million in profit from selling company shares in the months after the data warehouser learned that people's personal information may have been compromised and before the breach was made public, regulatory filings show. ChoicePoint's stock has dropped about 10 percent since last week when the company announced that criminals had duped it into allowing them access to its massive database. Alpharetta, Ga.-based ChoicePoint says the stock trading was pre-arranged under a plan approved by the company's board. Corporate governance experts say the pattern and timing of the trading by chief executive Derek Smith and president Douglas Curling raises questions. Smith and Curling did not respond to repeated requests through a spokesman for comment Friday.
Full Story: Twincities.com (Subscription Requred - use bugmenot.com) [twincities.com]
Big Brother's Little Helper? (Score:5, Informative)
One might easily assume that the executives are profiteering swine, and that the company's board members are colluding at the trough.
Furthermore, ChoicePoint has a
Re:I wonder how long ago they found out about this (Score:2)
I'd still call for firing the people if they're claiming that they're so out of touch with the company that they didn't know about its giant breach of security for
This has been coming for a _long_ time... (Score:5, Insightful)
1. unlimited storage capacity meant complex and detailed records could be kept on every person.
2. guaranteed incompetence meant these records would be abused, lost, exposed and manipulated.
I don't see either of these trends changing.
Applies to both commercial and governmental databases. Chaos, mess, confusion, abuse, on a huge and ever-increasing scale.
Welcome to the 21st century. You can opt out by unchecking the "Connect to the Internet" box about 10 years ago...
Not an Internet Issue (Score:3, Insightful)
For all we know, they were stolen out of the back of some truck and lifted by the overnight cleaning crew.
Re:This has been coming for a _long_ time... (Score:2)
To a certain extent, the failure is due to the manner in which the banking industry develops and merges. Each merger brings in a different se
Re:This has been coming for a _long_ time... (Score:2)
The "Internet" is not just your PC and the web, it includes all banks, all information processing institutions, and this lorry-full of magtapes.
The vanishing cost of storage combined with the universal constant of human incompetence is what caused this "fault".
I.e. asking banks and credit agencies to tighten their act is not going to help. They are and always have been structurally incompeten
Re:This has been coming for a _long_ time... (Score:2)
It's just that now, it affects terrabytes, not megabytes, of data at once.
It's pushing the petabyte range now.
Re:This has been coming for a _long_ time... (Score:2)
But first, we need to make sure politicians are accountable to the people, rather than corporations. Which is another can of worms.
Re:This has been coming for a _long_ time... (Score:2)
One more thing... (Score:5, Informative)
The following website explains it in governmentese:
http://www.gsa.gov/Portal/gsa/ep/channelView.do?p
For want of a nail... (Score:2)
I wonder how many of these customer data compromises ultimately are going to be chalked up to good old fashioned human error?
Yeah, I know, ultimately all of them until computers write their own programs (and that's the day that I unplug and head for
I mean stupid stuff, like a clerk misfiling a tape, or someone leaving a door unlocked, or something "non-computerish." Doesn't mollify the millions of people whose data are now at risk, I know.
You can't just throw automatio
Spooky Business (Score:4, Insightful)
-kgj
Re:Spooky Business (Score:2)
hee hee (Score:2)
fight club (Score:2)
did they loose the financial info too? seems like that'd be, um, a problem.
Myren
at odds (Score:4, Insightful)
"We deeply regret this unfortunate incident," Barbara Desoer, who is in charge of technology, service and fulfillment for the Charlotte-based bank, said in a statement. "The privacy of customer information receives the highest priority at Bank of America, and we take our responsibilities for safeguarding it very seriously."
Sen. Charles Schumer, a New York Democrat, told Reuters that he had been informed by the Senate Rules Committee that the data tapes were likely stolen off a commercial plane by baggage handlers.
So - they are so concerned about maintaining the security of their data that they gave it (in a very non-descript way mind you) to a group of people outside of their organization who have a history of struggling with integrity.
yippee...
Re:at odds (Score:2)
Wait, are you talking about the baggage handlers or the Managemenet of BofA?
Aftereffects (Score:3, Interesting)
about yay high (Score:2, Interesting)
Re:about yay high (Score:2)
Re:about yay high (Score:2, Interesting)
Re:about yay high (Score:3, Interesting)
http://www.datalinksales.com/cgi-bin/shop/datstor e
They are shipped in a flat white box about 12 x 12 x 1. Usually no other markings other than address label.
Cartridge tapes are smaller.
This sounds like one server reel being lost amongst a full backup.
Time to fight fire with fire! (Score:3, Funny)
Data loss is not acceptable (Score:4, Interesting)
Re:Data loss is not acceptable (Score:2)
Re:Data loss is not acceptable (Score:2)
Of course, Bank of America is one of the handful of "too big to fail" banks in the states, so nothing will likely be done to them.
Re:Data loss is not acceptable (Score:2, Informative)
nothing some campaign contributions can't fix (Score:2)
The value of Data (Score:2, Interesting)
The data of a company is one of its most important actives, and forever (long before the computers hage) the companies have tried to lock it, because it shows everything about its costumers, but also it shows everything about the co
My bank (Score:3, Informative)
What are they going to monitor? (Score:2)
Earilier in the article they said there are 2.1 million accounts and 1.2 million of those have been compromised.
How will it be possible to monitor for "unusual activity" on half of your accounts? Unusual when compared to the other half?
Not very realistic, I think.
Whats the problem here folks? (Score:2)
Meanwhile, at Bank of America... (Score:2)
admin 2:
sysadmin 1:
admin 2:
admin 1 + 2:
They Are Getting Fined! (Score:5, Funny)
Senate hearings on the way? (Score:3, Interesting)
privacy, get over it (Score:2)
Well, now that we've "gotten over" the loss of privacy, perhaps the next thing the McNeely's of the world will tell us is that we should get used this kind of identity theft lottery too.
I never got my BOA statement this month (Score:2)
I haven't signed up to pay on-line and was hoping the statement would just "show up" in the mail, so when I finally called them the other day and asked about this, the person on the other end said they had were aware of some "problems" at the moment with "some" accounts and would help me make a payment over the phone if I wanted.
For 25 years I've never had a credit card statement not show up. Is this related? I don't know.
good thing it was just tapes (Score:3, Funny)
Friend noticed odd processing on B of A account (Score:2, Informative)
A friend of mine was marvelling how Bank of America, which is normally very fast to process debits and checks written against a balance, seemed to lag a bit between late the week before last and mid this week. As in, none of his transactions against his balance posted for nearly a week, then in the middle of this week, they all posted at once. He speculated that they must have had computer problems for a few days.
I wonder if the behavior he was telling me
Slowly and slowly.... (Score:2)
At least, the government has no budget limits when it comes to security, whereas bean-counters are always breathing down the neck of private entreprise employees.
The People will wake-up that what private entreprise has been saying about "efficiency" is nothing but oxdung and claptrap to make them vote for whoever clamours that "we need less government", but in reality, t
This Is No Surprise - BOFA Is Run By Morons (Score:3, Insightful)
When I was arrested for bank robbery, part of the process involved a pre-sentencing interview by the Parole Department. I told them I worked at BOFA for two and a quarter years from January 1985 to April of 1987.
When they contacted BOFA to verify this, BOFA could not find any record I'd worked there, either under my name or SSN.
At the sentencing hearing, my PD told the judge he was prepared to produce names of supervisors, etc., to verify I had worked there. The judge decided that was unnecessary, commenting "It really makes you wonder how well they're keeping your money."
If they can't find employees, I'm sure they have no trouble losing customers.
BOFA is your typical big corporation - worse, a big bank. This means virtually everyone in the organization is incompetent and couldn't care less about their job.
As an example, I worked on customer support of the Microstar cash management system sold by BOFA's Automated Treasury Services Division to Fortune 1000 corporation treasury departments. This software package included a subsystem from a third party company which was riddled with bugs. When we in support were advised that the rest of that company's package was to be purchased and resold to replace the in-house developed part of the system, we advised against it. Ignoring us, management went ahead which resulted in 400 bugs in the bug database after rollout.
In the meantime, management concluded that the market for this package was "saturated" (no such thing in software - you upgrade and resell - where would Microsoft be if they thought the market was "saturated" after Windows 3.1?), so they either re-assigned or laid everybody off. The managers were promoted, and everybody else got dumped (or fired, in my case.)
So, yes, no surprise these morons lose customers.
Re:Why were the tapes on a plane to begin with? (Score:2)
Except a cargo plane full of media.
Re:Why were the tapes on a plane to begin with? (Score:3)
Re:Wonder if they were using Windows? (Score:2)
Re:Wonder if they were using Windows? (Score:4, Funny)
Re:Wonder if they were using Windows? (Score:2)
I can't believe that anyone would say such a thing.
Truly outrageous.
The french are responsible at least a third of the time.
hawk, wondering how long it takes someone to link this to the macmini . . .
Annoying (Score:5, Insightful)
The tapes were believed to be stolen by airport bagage handlers during shipment to BoA's offsite facility, likely another datacenter. It's still under investigation so the news agencies are not yet able to accurately report exactly what happened.
By all accounts BoA has made reasonable effort to protect its data, its tapes and its customers. BoA, and by proxy its customers, are the victim of theft. The blame lies squarely on the shoulders of the thieves and no where else.
In ANY incident, there will always be something more that could have been done to prevent the incident from happening. But, it becomes a question or reasonable care. Was reasonable care taken? It certainly seems as if it was in this case.
Let's put the blame where it belongs. Don't redirect the blame to the victims.
Re:Annoying (Score:2)
Now what do we do to fix it? Sure BoA is taking reasonable steps to avoid this happening, and I'm sure every other company this has happened to would say the same. The question is, what now?
We can't stop the thieves, I can only see two maybe three possible options:
#1. Make it more difficult to steal data. I feel this is what will probably be done, but then this problem is only mitigated, not fixed.
#2. Change the nature of the data. Make it useless to steal. Got your loan n
striping (Score:2)
send the stripes independently.
Make sure that there are at least three with reudundancy so that loss of a stripe or two is not catastrophic.
hawk
Re:Annoying (Score:2)
Re:Annoying (Score:2, Informative)
Re:most aggravating thing (Score:4, Insightful)
Sure, the senators are outraged that this happened. But they should be even more outraged that BoA chose to use a method so cheap to transfer critical data.
Quite a lot of 'critical data' and other items is moved on commercial airlines every day. Backup data such as this, organ transplants, diplomatic pouches, etc.
The airline is merely a subcontrator of BoA, charged with moving the stuff from A to B. An organization cannot handle everything inhouse. Quite a lot of functions are subcontracted out. The only more secure way would be for BoA to own and operate their own fleet of transport aircraft, with their own baggage handlers, and the data moved from the data center to the airport by their own security personnel, in their own armored trucks.
Same for a hospital. If they have to send your records somewhere, should the have to do it on their own aircraft?
Re:Conspiracy? (Score:2)
They are probably the entities most hurt (aside from the individual) when ID theft is perpetrated. They are the ones who will eat the loss.
Re:What's the Big Deal? (Score:3, Funny)
As an added bonus, citizens who purchase certain combinations of items will be awarded an all expenses paid trip to the beautiful country of Cuba.