Identity Theft and Data Compromises: The Beat Goes On (and an Important Caution)
Yesterday, it was LexisNexis (bold is mine):
In one of the biggest computer-security breaches ever, personal data on 310,000 people may have been stolen from data broker LexisNexis — nearly 10 times the number first disclosed, the company said Tuesday.
The disclosure, latest in a string of electronic break-ins, underscores the vulnerability of computerized personal data records. In incidents reported publicly since February, the rough tally is now approaching 1 million records potentially comprised at data broker ChoicePoint, San Jose Medical Group, Boston College and elsewhere.
A probe by LexisNexis’ London-based publishing parent, Reed Elsevier Group, determined that databases containing Social Security numbers and addresses had been fraudulently breached 59 times using stolen passwords.
The Dayton Daily News (link requires free registration), where LexisNexis is headquartered, notes something that the USAT piece doesn’t (and should have): “LexisNexis is notifying all these individuals and is offering free support services, including credit bureau reports, credit monitoring for one year and fraud insurance, to monitor and protect them from possible fraud associated with identity theft,” the company said.
The company response is fine in one sense, but its timeliness is weak. A prior post on the LexisNexis situation complimenting LexisNexis on its prompt response without qualification appears to have been premature. I’ll still give the company credit (so to speak) for notifying people when they learn of breaches, but they clearly have not performed well at discovering them on a timely basis, and have thus given potential ID thieves quite a head start.
Full disclosure (which I should have made earlier, and have added to the previous post): I have a done a very small amount of business (by anyone’s measurement) with Lexis Nexis in the distant past (at least 6 years ago).
Today, there is Polo Ralph Lauren (bold is mine):
Data apparently stolen from the popular clothing retailer Polo Ralph Lauren Corp. is forcing banks and credit card issuers to notify thousands of consumers that their credit-card information may have been exposed.
HSBC North America, a division of London-based HSBC Holdings PLC, has begun notifying holders of the HSBC-issued, General Motors-branded MasterCard that criminals may have obtained access to their credit card information and that the cards should be replaced.
HSBC spokesman Stephen E. Cohen said Thursday that “we began doing it last week, and we are continuing.”
He said that about 180,000 GM-branded card holders are affected.
I for one don’t get the relationship between a data theft at a retailer only affecting GM cards, but I’ll be on the lookout for details.
The HSBC decision to replace cards brings out a very important consumer point: If you even see an unathorized charge on your card, no matter how small, demand that it be replaced and the bank issue a new card with a new account number. Someone who obviously has your card number may be testing you to see if you’re paying attention. You’ve been compromised and have to act; don’t give thieves a chance to get away with anything bigger.









