Indiana Data Theft Compromises 700,000 52
palewook writes "A Midwest collection company, Central Collection Bureau, admits a server and eight PCs stolen contain over 700,000 individuals' personal data. Central Collection Bureau acts as a collection contractor for doctors and utility companies. The Indiana based company admits the stolen info consists of addresses, social security numbers, and medical codes."
Well this is a well timed article (Score:3, Interesting)
Re: (Score:2, Informative)
Re: (Score:2, Informative)
Re: (Score:3, Interesting)
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Re: (Score:3, Funny)
Take a CNN story like this, edit it to show your company as the culprit including how sales dropped dramatically, set it up on a web server somewhere, fabricate a CNN-spoofing URL to access it, and use an anonymous web email account to send it to those upper level managers along with a comment saying "do you want to avoid a situation like this?".
State-wide data theft (Score:2, Interesting)
Re: (Score:1)
Re: (Score:3, Interesting)
Right now, there's no reason why a company (or a state government) wouldn't keep as much data about you as it can. Hard drive space is all but free (especially relative to these types of transactional data) and big database engines can rapidly sort through the data when it's needed.
But, the problem is that
Re: (Score:3, Interesting)
Re: (Score:2)
That's what they get for outsourcing . . . (Score:4, Funny)
Re: (Score:2)
I have no problem with it. I speak Hoosierati fluently.
Business should assume that SSN is public (Score:4, Insightful)
The more these breaches happen, the more apparent it is that we need a better "proof of identity" mechanism. I'm not advocating for the government to pass out universal ID cards to everyone. I think I'd rather see something along the lines of SSL certificates, where business can issue identification to people and later use that number and passphrase to do business with them. Perhaps a handful of business certificates become the "gold standard" and and are accepted by other businesses as a valid identifier.
Re: (Score:3, Insightful)
Re: (Score:2)
EXACTLY!
For every fraudulant charge by an identity thief there is a bank that willingly handed out money to someone without actually knowing who they were.
Every time they hassle the victim of identity theft for the cash, they are shaking down an uninvolved 3rd party. Since they know very well they don't have any real proof of ID, from an ethical point of view, they might as well just shake down random pedestrians outside their office.
Ban that practice and you can bet they'll stop handing out credit ca
Re: (Score:2)
This identifier from cradle to grave is for the birds. It is the same for biometric stuff - once it is leaked a single time, the cat is out of the bag and you can'
Bunkum (Score:2)
- The "trust" you place in a digital certificate is misguided and fictional. Trust is a chain, and business cannot be "trusted" any more than the least scrupulous of their employees. If you organize data like this, it will just make it easier to steal. SSL certificates are okay for encrypting data, but next to useless for identity management.
- If all were implemented as you say, this computer theft would have taken the private keys as well, rendering the
Re: (Score:2)
The "trust" you place in a digital certificate is misguided and fictional. Trust is a chain, and business cannot be "trusted" any more than the least scrupulous of their employees. If you organize data like this, it will just make it easier to steal. SSL certificates are okay for encrypting data, but next to useless for identity management.
What are you smoking? This isn't about trust, it's about a way for the business to positively identify you as a specific customer. I don't have to trust the business,
Re: (Score:2)
Amazing for a card with the words, Not to be used for identification purposes on the back of it huh?
Re: (Score:2)
But you also need means for authentication. Signatures are not good, they can be easily forged.
However, there are low-tech measures, like personal seals (http://en.wikipedia.org/wiki/Inkan) which are almost impossible to forge.
Personal SSL certificates? Or even better, a small personal device like eToken? Maybe.
Personally, I like low-tech more (maybe because I'm a programmer
Re: (Score:2)
However, there are low-tech measures, like personal seals (http://en.wikipedia.org/wiki/Inkan) which are almost impossible to forge.
How would they be in the least bit impossible to forge? You just get a copy of something that the person has sealed. Use that as a basis to build a seal yourself and bam you're forging their identity. Your notion of it being impossible to forge might have been correct hundreds of years ago, but I very much doubt it would hold up against any modern forger. BTW from the wiki article:
The increasing ease with which modern technology allows hanko fraud is beginning to cause some concern that the present system will not be able to survive.
Re: (Score:2)
Besides, detecting a fake seal is fairly easy, it's almost exactly like matching a bullet to a gun using micro-grooves on bullets.
Signature expertise, on the other hand, is a highly subjective process.
Re: (Score:2)
It's impossible to make a perfect copy of a seal, which can't be distinguished using a microscope. The pattern of micro-features of a seal is unique (assuming that it's a wood or plastic seal, it's not true for metallic seals).
And how many times do you expect someone's seal imprint is actually looked at under a microscope? Never?
Besides, detecting a fake seal is fairly easy, it's almost exactly like matching a bullet to a gun using micro-grooves on bullets.
Did you even bother to read the wiki article that you linked?
The increasing ease with which modern technology allows hanko fraud is beginning to cause some concern that the present system will not be able to survive.
Apparently it's not that easy to detect in day to day transactions if the amount of fraud with respect to seals is becoming easier and easier to carry out.
You can talk all you want how it's detectable under a microscope, but do you honestly think that anyone does that on a regular basis? You can also tell the difference between counterfeit
Re: (Score:2)
And how many times do you expect someone's seal imprint is actually looked at under a microscope? Never?
For example, when you appeal a $100000 mortgage.
Did you even bother to read the wiki article that you linked?
My brother works at a criminal lab :)
Your solution is about as crappy as having people write their name on an index card and using that as a basis of ID verification.
No. I don't really care about $100-$200 frauds (which form the bulk of frauds). Merchants will just absorb the cost like they do with credit card frauds.
However, if someones takes a mortgage using a fake seal I want a reliable way to appeal it. Seals provide such a way, signatures do not.
Re: (Score:2)
For example, when you appeal a $100000 mortgage.
Do you have any actual evidence that they do this? I've read stories of people scamming hundreds of thousands of dollars when using fake hankos.
My brother works at a criminal lab :)
So that's a no that you didn't even read the article you linked? You sqawked on and on about how the fraud was easy to spot but the article you linked was saying that it was getting easier and easier to commit hanko fraud with modern technology. Did you perhaps fail at reading comprehension?
No. I don't really care about $100-$200 frauds (which form the bulk of frauds). Merchants will just absorb the cost like they do with credit card frauds.
So basically you admit that your system will have little impact when it comes to the vast majority of fraud. So then what was the point of the seal system again?
However, if someones takes a mortgage using a fake seal I want a reliable way to appeal it. Seals provide such a way, signatures do not.
You can do this right now without needing to use a seal.
Re: (Score:2)
Do you have any actual evidence that they do this? I've read stories of people scamming hundreds of thousands of dollars when using fake hankos.
Yes, I live in Russia and I'm the owner of a small company. Each company in Russia must have the company seal (with imprints registered in a state registry), this is a strong anti-fraud measure. I personally know about several causes of appealed fraudulent deals.
You can certainly scam hundreds thousands of dollars using fake seals, I don't doubt it. However, the victim of identity theft at least won't have to absorb the damage.
So that's a no that you didn't even read the article you linked? You sqawked on and on about how the fraud was easy to spot but the article you linked was saying that it was getting easier and easier to commit hanko fraud with modern technology. Did you perhaps fail at reading comprehension?
Yes, I've read it. I fail to see how it contradicts me.
It has also become easie
Re: (Score:2)
Yes, I live in Russia and I'm the owner of a small company. Each company in Russia must have the company seal (with imprints registered in a state registry), this is a strong anti-fraud measure. I personally know about several causes of appealed fraudulent deals.
So if you can point to several cases of fradulent deals being carried out using forged seals, it sort of shows that this system of seals is already broken.
You can certainly scam hundreds thousands of dollars using fake seals, I don't doubt it. However, the victim of identity theft at least won't have to absorb the damage.
You wouldn't have to know once the identity theft is uncovered.
Yes, I've read it. I fail to see how it contradicts me.
You don't see how it saying that it's increasingly easy to using forged seals contradicts your statement:
Besides, detecting a fake seal is fairly easy
If it was as easy as you claim, it wouldn't be getting easier and easier to commit fraud using forged seals as the article talks about.
It has also become easier to create counterfeit money, you just print them on a laser printer! Does it spell the end of paper money? I don't think so.
No, but it would fly in the face of someone procl
Re: (Score:2)
So if you can point to several cases of fradulent deals being carried out using forged seals, it sort of shows that this system of seals is already broken.
Any system is either "broken" or impossible to use.
You wouldn't have to know once the identity theft is uncovered.
How? You have no way to protest the deal. I've read about people losing hundreds thousands dollars on lawsuits to protest the fraudulent loans.
No, but it would fly in the face of someone proclaiming how easy it is to spot counterfeits when billions and billions in fake currency floats around at any one time.
No, that just means it's that protection measures of paper currency are adequate for the current situation.
I don't want 100% secure system which is also unusable and/or expensive.
Re: (Score:2)
I previously misread the post that's why I made this follow up.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Of course you'd have to put some kind of cap on damages (but it should
What authorities are saying (Score:4)
100k's compromised? (Score:1)
How does a server get stolen? (Score:2)
Oh wait, this is yet another completely wrong summary...
-Rick
Next, on World's Dumbest Criminals.... (Score:5, Funny)
Re: (Score:2)
Please note: you may want to steal the SS number of a doctor, I think their credit score is a bit better.
Re: (Score:1, Informative)
Health care providers are notorious for making almost no effort whatsoever to track down old patients that they forgot to bill for some random lab work. It's far easier (or in some cases more profitable) for them to just call it a loss, take the tax write-off, and sell the debt to a collection agency for pennies on the dollar.
It's to the point where most creditors simply ignor
Re: (Score:2)
Of course, with all of the "opportunities" for bad credit and no credit, this may actually be perfect! It's harder to get the account, but once they do, nobody will go looking for an identity theft given the victim's history.
The entire debt collections industry is already strongly biased towards assUmeing that any debt they buy is legitimate and the associated info like phone number and address are accurate even in the face of overwhelming evidence to the contrary. I say that as someone who has answered m
Not all have bad credit.... (Score:1)
It's just that hospitals also use credit agencies to help recoup monies that people are neglecting to pay, and not always for the reasons of bad credit.
So there is a good chance that a lot of those people will have great credit.
These Criminals may not be as stupid as many of you seem to think.