" /> Denise Richardson: April 2008 Archives

« March 2008 | Main | May 2008 »

April 30, 2008

April Brought More Than Showers...Hefty Data Losses Reported

Baltimore Highway Administration - [2008-04-25]
(Employee information for about 1,800 accidentally exposed on internal server)

Health Gloria Tam - [2008-04-25]
(Medical data and identity on 700 children exposed)

University of Colorado at Boulder - [2008-04-25]
(Names, addresses, and Social Security numbers of about 9,500 on compromised server)

WiseBuys - [2008-04-25]
(Hundreds of credit and debit card numbers reported stolen)

Chrysler Financial - [2008-04-23]
(Data tape lost in transit contained personal information)

Southern Connecticut State University - [2008-04-23]
(11,000 students and alumni exposed on website)

University of Texas Health Science Center - [2008-04-23]
(Social Security numbers available on about 2,000 billing envelopes)

CollegeInvest - [2008-04-22]
(Lost hard drive exposes 200,000 customers during office relocation)

University of Massachusetts - [2008-04-22]
(Hackers breach system accessing thousands of medical records)

Boots Dental Plan - [2008-04-22]
(Account details of 34,000 stolen from courier)

LendingTree - [2008-04-22]
(Social Security numbers, names, addresses, and other personal information inappropriately accessed)

Bank of Ireland - [2008-04-22]
(Account information, addresses, and medical information of 10,000 on stolen laptops)

Central Collection Bureau - [2008-04-19]
(Social Security numbers and names of 700,000 on stolen server)

University of Miami - [2008-04-17]
(Stolen tapes containing names, addresses, and medical records of 2.1 million patients)

Connecticut State University System / Buffalo State / Northwest Missouri State University - [2008-04-17]
(Stolen laptop contains names and Social Security numbers of 20,500 students)

University of Virginia - [2008-04-16]
(Social Security numbers and names of over 7,000 on stolen laptop)

Stokes County High Schools - [2008-04-14]
(Stolen computer exposes 800 student names and Social Security numbers)

University of Toledo - [2008-04-13]
(Name, address, and Social Security numbers for 6,488 exposed on internal server)

West Seneca School District - [2008-04-12]
(Students hack school district computer system 1,800 employees notified)

New York-Presbyterian Hospital/Weill Cornell Medical Center - [2008-04-11]
(Names, phone numbers and some Social Security numbers of 40,000 stolen by employee)

Joliet West High School - [2008-04-10]
(Names and Social Security numbers of "about every student enrolled" accessed)

Wellcare - [2008-4-08]
(71,000 insurance records including Social Security numbers exposed on internet)

WellPoint - [2008-04-08]
(Social Security numbers and medical information for about 128,000 exposed on internet)

Pfizer - [2008-04-07]
(Stolen laptop contains names and credit card numbers of about 800)

University of California, Irvine - [2008-04-04]
(Up to 7,000 affected - very few details available)

Okemo Mountain Resort - [2008-04-01]
(Computer network breach exposes tens of thousands of credit card transactions)

Advance Auto Parts - [2008-03-31]
("Network intrusion" exposes financial information for up to 56,000)

Source: Attrition.org
Find links for full details on these and other data breaches here.

Do you know what steps to take when your information is stolen -and then used to steal YOU?

April 28, 2008

Mike's Story: A Tangled Web of Fraud

By Guest Blogger: Mike Aliberti
South Florida

The following situation is a very difficult and lengthy ongoing matter that happened to me and for which I appreciate the offer to explain and share with you as a guest.

Manuel Marcelo Arvesu and Florida Title & Escrow Company conducted closings for their client, supposed licensed real estate broker Waldo Toyos III, the buyer in each transaction. Toyos III NEVER paid into escrow any required monies (deposits nor remaining balances of the selling prices).

Arvesu/Florida Title prepared closing statements showing the payoff of mortgages inducing each of the sellers to close, knowing that his client as buyer failed to pay required amounts in escrow. Each seller was paid net proceeds from other people's money in Arvesu/Florida Title's trust accounts. Each seller was represented by counsel to safeguard their interests.

Mortgages were NOT PAID according the closing statements leaving all financial/tax/legal liability with each seller despite transferring their titles. Yet, Arvesu/Toyos made monthly payments (in wrong amounts and many late) on mortgages that were NOT ASSUMABLE. Several months after each closing, the mortgages were paid in full. In my case, the loan was not paid for 22 months and for which I was being foreclosed 14 months after my December 31, 2003 closing from their wrong/missing/late payments which are still on my credit reports to this very day.

Arvesu/Toyos stole my social security number in February 2005, pretended to be me with the mortgage company to obtain the correct monthly payment, and then paid all outstanding amounts to remove the loan from default/foreclosure. Toyos then continued to pay eight more months on a NON ASSUMABLE mortgage in the proper amount until the loan was paid/satisfied by October 2005.

I filed a complaint to The Florida Bar against Arvesu that resulted in an audit/investigation of his trust accounts. The Florida Bar filed a Petition For Emergency Suspension which was granted by the Florida Supreme Court on June 30, 2006.

Arvesu was then disbarred on May 31, 2007 by the Florida Supreme Court
after he signed a Disbarment On Consent on April 18, 2007 (the day before his trial) to which he agreed with all of the facts/findings of The Florida Bar audit/investigation.

Arvesu used his own notary seal on the special warranty deed transferring my title. I filed a complaint to the Office of The Governor which was found to be valid, resulting in the request for immediate resignation in July 2006. Arvesu attempted to contest the resignation, finally relinquishing his certificate and seal in December 2006.

A second complaint was filed to The Florida Bar against Mark Hutner, an associate attorney of Arvesu, whose discipline is pending for conflict of interest, lack of communication, and other misconduct (i.e. perjury).

Hutner along with Arvesu continued to appear in the 11th Circuit Court from January 2004 through December 2005 without my consent or knowledge stating that they were my lawyers for matters pertaining to units that I sold (i.e. transferred title) on 12/31/2003.

Arvesu/Hutner actually lost the cases and for which judgments were recorded against me, of which I had no knowledge. They appealed to the 3rd District Court of Appeals stating that they were my lawyers for the appeal with my consent (I NEVER KNEW). In other words, they submitted a Substitution of Counsel in January 2004 to remove my former attorney from representation BUT failed to file a Substitution of Parties to remove me from the matters for TWO YEARS.

I also filed a complaint to the Florida Department of Business & Professional Regulation in February 2005. Subsequently, the Division of Real Estate filed an Administrative Complaint to the Florida Real Estate Commission on January 17, 2008 against Toyos III for seven counts/charges for which he was found GUILTY by the probable cause panel.

Since Toyos III has contested the allegations of fact, a formal hearing is scheduled with the Division of Administrative Hearings on June 11-12, 2008. Administrative Law Judge Larry J. Sartin in Tallahassee will appear by televideoconferene for the hearing being held in Lauderdale Lakes.

A second case (2005029655) is pending against Waldo Toyos Jr. (the father) as Toyos III was representing that he was a licensed broker when Jr. (the father) actually was the licensee. Throughout each closing, Toyos III supposedly had a sales associate license that was inactive to orchestrate the fraud/scheme causing the credit damages. The complete docket for the Toyos III hearing can be viewed online here.

Criminal investigations are ongoing by the Coral Gables Police Department Economic Crimes Unit for the State Attorney's Office in Miami and the Miami office of the FBI for the separate federal investigation. The ease with which licensed professionals as criminals like Arvesu/Hutner/Toyos can decimate a person's credit is AWFUL, with lifelong issues of a compromised identity.

They have wasted money to pay attorneys (as many as six lawyers, one a former Circuit Court judge) and another who killed himself on May 10, 2007) to harass/victimize consumers like me, waste judicial and my personal resources, as well as abuse the civil court system. After all, they have already been found GUILTY for counts/charges by other administrative/government and professional venues or organizations.

I hope that my sharing my personal and difficult situation can help you to avoid subsequent matters of your own - or at least to know some ways to help protect yourself from reading my examples (I have many more to share if you want to contact me personally).

Michael A. Aliberti, MSW.

April 25, 2008

Attorney General Warns of Two Separate Incidents Threatening Floridians' Personal Information

TALLAHASSEE, FL – Attorney General Bill McCollum today issued a consumer advisory warning of two separate incidents where Floridians' personal identification information may have been compromised.

The first incident was originally reported by the Florida Office of Financial Regulation, which warned state employees that some individual has been calling state employees, claiming to be with the State of Florida's Division of Securities in an effort to obtain personal financial information.

The second data breach was recently reported by LendingTree, who contacted its consumers to warn them their personal information may have been exposed on mortgage applications.

The first data alert warns of an identity theft scam commonly referred to as a "phishing" scheme through which identity thieves use the information they are able to obtain to steal individuals' identity and eventually, their financial assets.

According to the Florida Office of Financial Regulation, the Division of Securities will not ask for PIN numbers, passwords or similar secret access information for credit card, bank or other financial accounts.

Individuals, including state employees, who receive a phone call from someone claiming to be a government agency and asking for confidential information should assume the call is fraudulent and avoid providing any information. An important suggestion is to independently verify the authenticity of the call by calling the state agency directly and asking about the incident.

Likewise, Floridians are cautioned to be wary of e-mails asking to verify or provide account information. More information about preventing identity theft is available online at: http://myfloridalegal.com/identitytheft.

The second incident involves a situation with LendingTree, an online company that offers consumers the opportunity to compare lending and realty services. Recently, LendingTree learned that several former employees may have helped mortgage lenders gain access to LendingTree's customer information by sharing confidential passwords with the lenders. The company has since contacted the authorities and is helping with their investigation. The company has also stated it made several system security changes since discovering the problem.

Consumer advisories have gone out to affected LendingTree customers, and the Attorney General is urging any affected consumers to immediately take the necessary steps to secure their information, including requesting a free credit report.

A credit report can help consumers look for any accounts they didn't open and/or inquiries from creditors that they didn't initiate. If there is any information on the report that a consumer did not authorize, he or she should immediately contact the credit bureau, and if necessary, file a fraud alert with the bureaus.

While the company has not released any information about how many consumers may have been affected, Attorney General McCollum encouraged all LendingTree customers to be alert and monitor any suspicious activity on their bank accounts, credit card statements and credit reports.

The Attorney General stressed the importance of being proactive to prevent identity theft and reminded consumers that anyone may contact the Attorney General's fraud hotline at 1-866-966-7226 for further assistance.

***************************************************************************************

The Fair and Accurate Credit Transactions Act (FACTA) is a federal law that forced each of the nation's credit reporting agencies (Experian, Equifax and Trans Union) to provide one free credit report each year to every American. Unfortunately, FACTA didn't force them to publicize how you should take advantage of this right.

To find out how to get your free annual credit report click here

***************************************************************************************

Steps to avoid fraud & how to keep id thieves out of your accounts

April 24, 2008

Here's Why We Need The Right To Receive A Monthly Mortgage Statement ON All Mortgages!

I have highlighted Jack Wright's story (founder of msfraud.org ) on several occasions . Msfraud.org is a site founded and built by the many victims of mortgage servicing fraud.

Here are a couple of youtube videos that cut to the core of the mortgage servicing nightmare . It points out how an innocent man (one of many) had his home foreclosed on -yet he hadn't missed a payment. In fact, Jack overpaid and still lost his home. If we don't expose what is happening to innocent borrowers, who will stop it? What happened to Jack could happen to anyone who holds a mortgage and doesn't receive a monthly statement that tracks and verifies payments are applied accurately. Jack's story and his site points out why consumers should be allowed monthly statements on all mortgage accounts .

Watch these videos, then read the comments and sign the Petition for Monthly Statements Here

The home you save might just be your own! All too often the media doesn't dig deep enough to find the truth behind the spin. Victims are being labled deadbeats who don't pay their mortagages -watch these videos and then ask yourself if Jack or Dale are deadbeats?

See more:

*************************************************************
Jack Lost his house!

And he's still fighting for justice and accountability! Jack's not alone.

Here's another video of a Florida woman whose home was about to be auctioned off on the court house steps -even though she never missed a payment!

These are the types of stories that aren't getting out there -but need to be told.

Watch for an interview with Jack Wright and other mortgage servicing victims coming soon!
******************************************************************

For more about the far reaching effects of illegal foreclosures see;

Paying your bills on time? A Monthly Statement & Your Credit Report May Say Otherwise...

Pay your mortgage on time and you won't have a problem. Wrong!

What if we could stop some foreclosure nightmares? We could -but it would take an Act of Congress!

I -Team: Mortgage-Servicing Companies(WBZ) This is an I-Team investigation that every property owner should read or watch. The focus: mortgage-servicing companies. These are the firms that lenders choose to handle your mortgage payments. MORE

Coming Soon: Victims of Mortgage Servicing Fraud Speak Out!

April 23, 2008

Identity Theft Resource Center Applauds the DoD Military ID Change

(San Diego, CA) Since 1969, our military members have had their Social Security numbers used as their military ID number. It was on dog tags, items of clothing, duffle bags, and all their records. This policy potentially put service members at high risk of identity theft due to the multiple places the SSN could be accessed by anyone looking to commit identity theft. This could be another military member, a civilian working on base, or even the enemy. The simple act of losing a wallet could jeopardize a serviceman.

As one serviceman said to Congress, “While I am concerned about myself, I am even more concerned for those 19-year-old soldiers and their families that are so easily victimized by this crime. Imagine their spouses, new to the way of the military, trying to balance the day-to-day challenges of a young family, with the crippling effects of identity theft. Furthermore, I am concerned because I can see how it could be nearly impossible to fight identity theft problems from another part of the world. I can be deployed overseas without notice. Quite honestly, my family and I do not need the additional stress imposed on us by this crime.”

How can we expect a serviceman to clear up identity theft while serving in one of the remote places in the world? While running drills aboard a ballistic missile submarine or while patrolling a dark street in Bagdad? The simple answer is, they cannot. And their inability to act may result in financial ruin. How can they concentrate on their jobs, protecting themselves and their fellow servicemen, with this fear on their minds?

“These patriotic men and women have volunteered to serve our country. They have put their lives on the line to protect and defend our freedom. We owe our military members more,” urged Sheila Gordon, ITRC’s Director of Victim Services and a daughter of a career officer.

The Identity Theft Resource Center has spoken out loudly about this problem since 2000. According to an American Forces New Service report, the military is now moving to partially truncate all but the last four
numbers of the Social Security number from military identification cards. By 2010, the program will be completed, with new ID cards issued as they expire.

“On behalf of the Identity Theft Resource Center, we thank the Department of Defense for this long-needed change. Military members and families make sacrifices to protect us. It is long overdue that we begin to protect them,” stated Jay Foley, ITRC Executive Director.

The ITRC is a non-profit organization established to support victims of identity theft in resolving their cases, and to broaden public education and awareness in the understanding of identity theft. It is the on-going mission of the ITRC to assist victims, educate consumers, research identity theft and increase public and corporate awareness about this problem.
********************************************************************************

For more info for our Military see an earlier blog: ICFE Cautions Veterans and Active Duty Service Members

First 3 Days of This Week Bring Several Newly Reported Data Breaches

Social Security Numbers Exposed On Hospital Bills

April 23, 2008 -Some 2,000 medical bills were mailed around East Texas last week with patients' Social Security numbers visible on the envelope after a technical glitch skewed billing at the collection agency used by the University of Texas Health Science Center at Tyler.

Chief Operating Officer Rob Marshall at UTHSCT said the problem was quickly addressed and fixed, but his disappointment in collection agency CBE Group Inc. might not be repairable.

"We're in negotiations ... I can't confirm or deny that we'll be with (CBE) in the future," he said Tuesday evening. "But we do have a different set of rules on handling issues like this and have already said how to safeguard this in the future." MORE

*****************************************************
Boots customer bank details taken…stolen in early April

April 22, 2008-Personal details of thousands of customers of Boots' dental plan have been stolen after a courier car was broken into in Bristol.

The information from Boots Dental Plan included customer bank account details, but officials claimed it was "highly unlikely" these could be accessed.

The details of 27,000 customers and 7,000 employees were stolen on 3 April.

Boots and Medisure, who administer the plan for the company, said all customers had been informed.

The Financial Services Authority said it had been given details of the theft and would be looking at the case. MORE

***************************************************************
LendingTree tells clients of breach

Improperly accessed files included information on mortgage customers

April 22, 2008-Adding to a growing list of companies suffering data breaches, LendingTree notified mortgage customers Monday that some of their personal information may have been inappropriately accessed.

In a letter, the Charlotte-based company said that outside loan companies may have accessed the information, including Social Security numbers, between October 2006 and early 2008 and used it to market their own mortgages to LendingTree customers.

LendingTree would not say Monday when it learned of the incident or how many people were potentially affected. It sent e-mails to alert customers it believes may be at risk of having their information accessed.

The company said it does not believe the disclosure led to identity theft or fraudulent financial activity, but recommended customers check their credit reports for suspicious activity.

In the letter, the online loan finder and lender said its internal security uncovered the incident, prompting an internal investigation and a report to authorities.

According to a Q&A sent to customers, "several former employees" may have shared confidential passwords with "a handful" of lenders that were not approved by the company.

The lenders then used those passwords to access customer information files that contained mortgage request data such as name, address, e-mail address, phone number, Social Security number, income and employment information. The files did not contain credit card information, LendingTree said. MORE

*************************************************************
10,000 bank account details stolen

April 22, 2008 -POTENTIALLY invaluable personal and account details of 10,000 Bank of Ireland customers, including passwords and medical histories, are missing.

Last night Data Protection Commissioner Billy Hawkes said the matter had been brought to his attention last Friday while the data . gathered by the bank's life assurance division and contained in four laptop computers - has been missing since last year.

Mr Hawkes said Bank of Ireland personnel had told his office that they became aware of the sensitive nature of what was contained in the stolen laptops last week.

The computers had not been encrypted.

The four computers that held the information on bank customers, including home addresses, bank account details and medical records, were stolen between June and October of last year.

One of the laptops was taken in a break-in at the home of a bank employee. The other three are understood to have been stolen from parked cars. MORE

**********************************************************************

Server Theft Exposes Data on 700,000 Consumers

Break-in at debt collection company puts Indiana citizens' personal information at risk

APRIL 21, 2008 | Some 700,000 consumers' personal data is at risk today after the theft of a server and eight PCs from a debt collection company in Indiana last month.

The owner of the company, Central Collection Bureau, revealed the breach this weekend and said it is working with police and the Indiana attorney general's office, according to a report. CCB says it has improved security at its office, but 700,000 names stored on a handful of computers are now in the hands of thieves.

The computers contain the names of hundreds of thousands of people, as well as their addresses, Social Security numbers, and in some cases, medical codes. The collection company was hired by hundreds of doctors and some utility companies to collect on delinquent bills. Every name is a customer or a patient.

"Obviously, we need to be notifying those that could have potentially had information on there. We are recommending that they put credit freezes on or at least monitoring on their credit reports," said Chet Klene, Central Collection Bureau.

"Our server was password protected," Klene said. "We have obviously spoken to some IT people who feel that a good computer hacker could get through those passwords." MORE

**********************************************************
For more info see a few prior blogs:

Growing Corporate Concerns Over How to Safely Store Your Data

You may fiercely protect your personal information...But what happens when "others" don't?

Another Day -Another Data Breach...

April 22, 2008

If You Have A Texaco or Chevron Credit Card -Review Your Statement Carefully

This is a true and personal story written by my friend and colleague Jim Malmberg, executive director of ACCESS (American Consumer Credit Education Support Services) whose wife recently learned she was being charged hefty fees, she didn’t owe. No, nothing new or surprising...just a warning for consumer;

Look Closely at your Chevron and Texaco Credit Card Bills This Month

If you have a gas credit card from either Texaco or Chevron, you need to look closely at your bill this month. There is a chance that you were charged a late fee due to their screw-up. The charge was apparently caused by a change of ownership of their credit cards. But the company isn't volunteering to make refunds.

This is actually a personal story that appears to affect a large portion of Chevron's customers. My wife has had a Chevron card for many years now, and she has never been late on a payment. But that didn't stop GE Money Bank, the new owner of Chevron and Texaco cards from issuing a late notice even though her payment was processed on the day it was due!

It all started with a rather nasty letter that my wife received last week. The letter said that she had sent her payment to the wrong processing address. This is very interesting since the address that she sent her payment to was the address printed on her payment coupon - a coupon which was printed by Chevron. Still, according to the letter, "You were previously notified of a change in ownership of your Chevron / Texaco Credit Card account." Well, no she wasn't. But we'll let that go for a minute.

The letter went on to provide the "correct" processing address and to inform her that if she didn't change the place that she was sending her payments, she might be hit with late fees due to a delay in processing.

The day after she received the aforementioned letter, she received her latest Chevron bill. There were two items of significant interest on the bill. First was that her last payment had been processed on 4/1/08, which was the actual due date for her bill. The second item was a late fee... for what, we are not sure. Apparently, one day notice was enough for Chevron and they wanted to get a jump start on the next quarter revenues. Maybe they can squeeze out an extra billion or two in late fees; as if oil prices weren't high enough already.

But my wife doesn't intend to be a contributor to Chevron's effort. Such a Scrooge! So this morning, she sat down and called Chevron and found that the company had a prerecorded message on its line, stating that they sent out a letter in error to many customers about changes in their billing address. They then went on to apologize for any inconvenience. (As an aside, they could have said that "if you received such a letter, any late charges will be refunded and you don't have to spend an inordinate amount of time hanging around here to speak with a customer service agent." But they didn't do that. So much for the apology.) She was then put on hold for a good twenty minutes.

When an operator finally did come on the line, she wasn't very pleasant. Even after explaining the situation to the operator, the best she could get was that they would make a "one-time courtesy adjustment" to her bill and waive the charge. How Chevron was doing her a courtesy by cleaning up its own mistake and making her waste her time was never really explained. Is that really any way to treat someone who has been a good customer for years? It must be some new secret strategy by the company's marketing geniuses! I'm simply too dumb to understand it.

By virtue of the fact that Chevron, or perhaps it is GE Money Services, has a prerecorded message on their customer service phone line noting that they made a mistake, they are fully aware that they were the cause of the problem. It also means that they know it is a large scale problem.

The company knows who they sent the letters to, and they should just automatically credit the charges and issue a letter of apology. But there is no indication that they are doing this. There is no mention of the issue on their credit card website either. That's not good because it doesn't give cardholders the feeling that the company wants to do "the right thing".

The only thing we can say to Chevron / Texaco customers is look closely at your bill this month. Just because you paid your bill on time doesn't mean that you won't be hit-up for a late fee. And even if your bill is late, it may be through no fault of your own. You may just have sent your payment to the wrong address - the address Chevron printed on your payment coupon. Now why in the world would you do a stupid thing like that?

April 21, 2008

Peter's Story: Can Anyone Help Me Wake Up From This Mortgage Nightmare?

Denise, I will try to be brief but the deceit has caused me such emotional turmoil that I feel like giving up.

My problem began when I went to the closing of my loan on March 23, 2006 and all the numbers for the mortgage changed - the interest rate, and the closing costs as well.

I saw they had added an ARM when I was promised a fixed rate.

When I complained the brokers insisted that it was a fixed rate, fixed for three years.

I refused to sign the loan and told them to go back to Countrywide and rework the loan, they scheduled another closing the following week on the 27th.

I still was not happy with the reworked numbers and when I told them I would not sign them, they threatened to sue me for breach, and would further sue me for all the closing costs which amounted to $24,000 on a $199,000.00 loan.

I knew I had three day's to rescind the mortgage, which would give me time to research their threat of suing me for all the closing expenses.

Two two day's later my bank called to inform me that Countrywide wired the funds into my account before my rescission period was up.

When I called Countrywide to inform them they did not give me my three day right of rescission to rescind the loan as mandated by law, they referred me to their Jacksonville office.

I informed the Jacksonville office and they said they would conduct an investigation.

After making many follow up calls to learn if there was any progress and receiving no response, I called the Countrywide' fraud hotline. Again, no response.

I once again called Countrywide’s customer service phone number and after being transferred numerous times, I finally got someone to listen to me and promised to start an investigation.

To finish reading Peter's story in his words click here

If you think you can help Peter -please email me and I will get you in touch with him.

Bankrate Releases National Poll Results: 8 out of 10 Americans are concerned about ID theft

NEW YORK, April 21 /PRNewswire-FirstCall/ -- Bankrate, Inc. today released the findings of a national poll which found that 8 out of 10 Americans are concerned about their identity being stolen. Furthermore, over one-third (34%) of Americans know someone who has been a victim of identity theft. The poll is included in this month's segment of Bankrate's Financial Literacy Series: Protect your identity. To view Bankrate's Financial Literacy 2008 - Guide to Building Personal Wealth, click here.

****************************************************************** From today's Headlines:
Here's an example of why we have good reason to fear id theft;

700,000 Hoosier ID's compromised in computer theft

THE INDIANAPOLIS STAR

INDIANAPOLIS -- A computer server containing Social Security numbers and other personal information of 700,000 people was stolen last month from a Southside debt-collection bureau in what appears to be the largest computer security breach ever in Indiana.

The information includes customer-billing records for about 100 Indiana businesses, including Citizens Gas & Coke Utility, St. Vincent Health and Methodist Medical Group.

The exposed data was limited to past-due billing information that had been turned over for debt collection to the Central Collection Bureau, the agency announced Friday. Customers whose accounts were in good standing were not affected.

The bureau collected overdue bills on behalf of dozens of Indiana companies, including hospitals, medical and dental offices, window companies, water-conditioning companies and flower shops.

"We're obviously heartsick about this," said Chet Klene, the collection agency's president. "We've been in business since 1972, and nothing like this has ever happened before."

He said the missing computer server contained personal billing information that was protected by two passwords but was not encrypted. He said the server had been stored behind three locked doors.

Klene said the break-in occurred on Good Friday, March 20. The first employee arriving at work that day noticed the break-in and immediately called the Indianapolis Metropolitan Police Department, which investigated but has not found the server. The collection agency has notified companies whose billing records have been compromised, Klene said.

Joan Antokol, a lawyer specializing in computer security at Baker & Daniels, an Indianapolis-based law firm, said the breach was the largest she had seen in Indiana. No larger breaches in Indiana are included among the hundreds of incidents listed on Privacy Rights.org, a national clearinghouse.

"It's a problem that continues to grow," Antokol said. "There are new cases reported all the time. It's a serious problem."

Still, this breach does not rank among the top dozen or so nationally. Retailer TJ Maxx reported that as many as 100 million accounts were compromised as a result of thefts and hack-ins since last year.

The U.S. Department of Veterans Affairs said information on more than 28 million veterans might have been exposed after a laptop was stolen from an employee's house in 2006. Monster.com, a Web-based job service, said information on more than 1 million job seekers had been stolen last year, containing names, addresses, phone numbers and e-mail addresses.

A spokesman for Citizens Gas said its missing records were past-due billing statements for 51,000 former customers that it was unable to find on its own. The information included names, last known addresses, Social Security numbers, dates of service and amount due.

Citizens has no way of notifying the former customers because their whereabouts are unknown, spokesman Dan Considine said.

"We certainly take this very seriously, any time there is a security breach, and we hope it gets cleared up very soon," he said.

St. Vincent Health said it had not given any billing business to Central Collection in more than three years, so all of the missing billing information is several years old. The stolen information included patient billing information for St. Vincent Hospital and affiliated physicians' practices, spokesman Johnny Smith said.

"We're committed to protecting confidential information of our patients. We regret any inconvenience to them," Smith said.

Billing records of about 62,000 patients of Methodist Medical Group, a physicians' group owned by Clarian Health, also were missing, as are the records of thousands of patients at Howard Regional Health System in Kokomo.

The break-in is being investigated by IMPD and the Indiana attorney general's office.

************************************************************** and;

Michigan Students Told of Possible Data Theft

Traverse City - A computer theft could put the personal information of 1,600 Northern Michigan College students from 2003 at risk.

The college released a report Friday saying a laptop computer was stolen from a company called SunGard Higher Education. SunGard provides the college core data management systems.

The company told Northern of the theft April 10, nearly a month after the computer was stolen. The college found out about the data on the computer on April 16.

"We also have expressed our deep concern to SunGard about the length of time it took them to notify us of this incident," said Craig Mulder, NMC's Executive Director of Learning Resources and Technologies. MORE

**********************************************************and,

ID theft by Russian gang prompts police prevention effort

A wave of information thefts from retail PIN pads by a Russian gang has prompted Victoria-area police to launch a campaign to get area businesses to tighten security.

The Victoria area has twice been hit by a Russian gang, says Sergeant John Price of the Saanich police. It is believed to have since moved back to the Mainland. It doctors PIN pads in groceries and other high-volume retailers to reveal customers’ PINs and account numbers. The gang then loots the accounts.

$102 million was stolen last year via debit card data theft, says Price.

“Their methods keep changing,” says Price. “This is the latest. The gang started with this in Ontario and Quebec and has moved to the Lower Mainland.” The group keeps switching locations as storekeepers in one area become more cautious.

After an initial wave of account thefts hit the Victoria area in December, police alerted storekeepers to the gang’s modus operandi. The gang apparently moved on, perhaps up-island, but then returned for a second attack. “One storekeeper caught on as it was going down and called us,” says Price. “We knew they were back.”

No arrests have been made but Price says police have good leads on the gang, not least of which is security camera footage of the gang in action

The scheme may begin with the outright theft of a checkout card reader, which is modified with Bluetooth short-range wireless technology and switched later with the card reader at a different store. MORE

****************************************************and;

Brunswick warns on possible identity theft

Brunswick Corp. disclosed Monday that an electronic devices that scans customers' drivers' licenses to make sure they're of legal drinking age was stolen from a company-owned bowling facility in suburban Naperville.

The scanning device, which verifies whether a license has been tampered with by reading a license's magnetic strip, is capable of retaining personal information of up to 700 of the latest patrons whose cards were swiped through the machine. MORE

April 20, 2008

How to Keep Identity Thieves Out Of Your Accounts

Most computer users repeat passwords, at their peril

SAN FRANCISCO --AP Using the same password for multiple Web pages is the Internet-era equivalent of having the same key for your home, car and bank safe-deposit box.

Even though a universal password is like gold for cyber crooks because they can use it to steal all of a person's sensitive data at once, nearly half the Internet users queried in a new survey said they use just one password for all their online accounts.

At the same time, 88 percent of the 800 people interviewed in the U.S. and the U.K. for the survey by the Accenture consultancy, which is to be released Thursday, said personal irresponsibility, is the key cause of identity theft and fraud.

Researchers say the findings suggest that many users underestimate the growing threat from organized cyber criminals who can reap big profits from selling stolen identities.

"There's a lot of confusion out there - a lot of people don't think there's a problem," said Robert Dyson, a senior executive in Accenture's global security practice. "There's still the kind of head-in-the-sand situation: 'My identity hasn't been stolen. I don't know anybody who's had their identity stolen. So it must not be happening.'"

Dyson said the problem with repeating passwords is that a hacker who successfully breaks into one account then has an easy time guessing how to get into all the user's other accounts.

Many users repeat passwords so they don't forget them, which shows in another finding that 70 percent of survey respondents in the U.K. said they don't write down their passwords, versus 49 percent in the U.S.

Only seven percent of the respondents said they change their passwords often, use password management software or use a fingerprint reader to access their machines and accounts.

The survey looked at people who used a computer at home, have high-speed Internet access and go online at least twice a week for something other than checking e-mail. The respondents were selected at random and questioned over the telephone. The mean age was 46.

The survey's margin of error was plus or minus 3.5 percent for the total sample and plus or minus 4.9 percent for U.S. and U.K. samples.

Accenture noted that the results represent the behavior of a random sample of this subgroup of Internet users, not the overall general pool of U.S. and U.K. consumers.

*************************************************************************
To lessen the odds of falling victim to fraud, here are three tips to remember...

1. Prevent thieves from cracking passwords. Pick Passwords and profiles carefully. Pet names, birthdates, interests such as favorite sport team or band, favorite hangouts, hobbies, spouses, street addresses and children’s names are often compiled in passwords and thieves know this. They use these bits of information to crack your password and then get into bank accounts or other online sites you frequent such as Amazon, itunes or anywhere you utilize that password, including email accounts, to purchase goods and services.

2. Profiles and posts are never private. Employers often Google a prospective employee’s name to see what is on their personal pages or what others post about them.

3. Don't provide any personal information such as your Social Security number, bank account numbers or credit card data to anyone who contacts you via email or through social networking sites. Oftentimes, scam emails are phishing schemes designed to appear authentic and urgent -but they are not! If you receive a notice from someone instructing you to verify your account information, provide personal identifying information, or click on a link -don't do it! Some emails will ask you to dial an 800 number that if called can dial directly to thieves on the other end -just waiting to take your information. If you believe the email is from someone you do business with, check your statement or legitimate documentation for the institutions valid phone number. Fake websites and bogus 800 numbers are often included in “phishing” email scams. Remember, legitimate companies or government entities will not ask for this information through emails.

For More Tips See:

Students & Social Networking sites -favorite targets of thieves

April 18, 2008

Miami Hospital Data Breach: UM Notifying 47,000 patients

UM says confidential patient information stolen last month

MIAMI (AP) -- School officials say confidential information of tens of thousands of University of Miami patients was stolen.

UM says someone stole a case last month that had the information on computer tapes.

The information includes names, addresses, Social Security numbers or health information. Anyone who was a patient or visited an UM facility since Jan. 1 1999 may be affected.

UM says it will notify 47,000 patients by mail whose records may have included credit card or other financial information.

The university had computer security experts try to access data from a similar set of backup tapes. But the school says the experts concluded it would be difficult to get "usable data from the tapes."

The University's permanent records are not affected.

*********************************************************************************
For More info see:

Announcement from the University of Miami

Anuncio de la Universidad de Miami


April 17, 2008

Federal Prosecutors Claim Computer Security Expert Engaged in Widespread Identity Theft & Fraud

US consultant pleads guilty to identity theft:

A Los Angeles man Wednesday pleaded guilty to using spyware that turned thousands of computers across the United States into "zombies" so he could steal their owners' identities.

LOS ANGELES (AFP) — A 26-year-old computer consultant pleaded guilty Wednesday to raiding hundreds of thousands of computers with spyware to steal users' identities and commit fraud.

John Schiefer, who worked as a computer security expert, "admitted that he gained access without authorization to hundreds of thousands of computers in the United States and that he remotely controlled these compromised machines through computer servers," federal prosecutors said in a statement.

"Once in control of the 'zombie" computers, Schiefer used his botnets to search for vulnerabilities in other computers, intercept electronic communications and engage in identity theft," the US Attorney's office said.

Schiefer pleaded guilty to gaining access to protected computers to conduct fraud, divulging illegally intercepted electronic communications, wire fraud and bank fraud, the statement said.

He is the first person in the country to plead guilty to wiretapping charges in connection with the use of botnets, or computers controlled remotely, authorities said.

Schiefer, who used the online name "acidstorm," is to be sentenced on August 20. He faces a maximum of 60 years in federal prison and a fine of 1.75 million dollars.

April 16, 2008

SCAM ALERT: Corporate Executives Target of Identity Theft Schemes

Identity Theft Smash & Grab, CEO Style
Source: WashingtonPost.com

Tens of thousands of corporate executives were the target of a series of identity-theft scams this week, e-mail-borne schemes that appear to have netted close to 2,000 victims so far.

Early Monday morning, according to two security experts with firsthand knowledge of the attacks, nearly 20,000 executives received an e-mail purporting to be a subpoena ordering each recipient to appear in court for legal violations leveled against their company. The messages addressed each executive by name, and included their phone number and the name of their company.

Recipients who clicked the link were brought to a Web page that claimed they needed to install a Web browser add-on in order to view the subpoena. Those who agreed were shown an Adobe PDF document that referenced a lawsuit filed in a California district court.

The "add-on" in question was a component designed to steal usernames and passwords when the victim subsequently visited an online bank site or other page that requires those credentials (the malicious add-on only installed for users visiting the site with Microsoft's Internet Explorer Web browser). Approximately half of the recipients of the e-mail messages were executives at major financial institutions.

These types of targeted attacks are hardly uncommon, as cyber crime has grown more sophisticated and criminals more successful in stealing money from average home Internet users and businesses. But what distinguishes this week's attacks is that they have been hugely successful even though the methods employed by the cyber criminals directing them rank near the bottom of the scale in terms of sophistication and stealth. MORE

**************************************************************
See other recent Scam Alerts

Beware of New Spam E-mail "Meeting Invite" -Don't Open

Beware of E-Mail and Telephone Phishing Scams...


April 15, 2008

IRS To Begin New Program Focused on Identity Theft This Fall

WASHINGTON -- Thousands of people each year send in their income taxes only to be told by the Internal Revenue Service that they have already filed.

It is not a welcome surprise. It is identity theft.

In testimony Thursday to the Senate Finance Committee, Russell George, Treasury Department inspector general for tax administration, said there are two types of taxpayer identity theft.

In one, someone files a return under a stolen name and Social Security number to steal the refund. In another scenario, someone steals a Social Security number as an employee and the income taxes are assigned to the wrong person.

Sen. Max Baucus, D-Mont., noted that springtime is tax time, when taxpayers do not enjoy financial surprises. He said some victims of identity theft learn about the fraud quickly. Others have no idea they're being victimized and the discovery process takes years.

A Federal Trade Commission report to the committee in 2006 indicated that the number of identity-theft victims had almost tripled from 18,000 in 2002, Baucus said.

IRS Commissioner Douglas H. Shulman, who took office March 24, testified that the IRS has changed the way identity-theft cases are recognized and handled in the last few years. He said there have been more cases, but there's also been an increase in reporting. Because false identity eludes the system, it is hard to know exactly how prevalent it is.

Rebecca Spencer, who owns and manages a tax-filing service in Billings, Mont., told the panel that one of her longtime clients, a struggling single mother of two, tried to file early and learned that someone had already filed under her name.

"My client, of course, was in tears and, not knowing who to call, I started with the IRS Criminal Investigation 800 number" and reached a recording, Spencer said. After a series of additional calls and waits, she was told the client would need to file a paper return.

Ten days after Spencer and her client notified the IRS of the identity theft, the agency released the tax refund to the thief. It was only because Spencer notified the bank -- not because of IRS actions -- that the thief was unable to receive the money, Spencer said.

"Anyone with a little prior planning can take a laptop into a cyber-cafe with a stolen Social Security card and an employer identification number and file a United States income-tax return," Spencer said.

Nina E. Olson, the IRS' national taxpayer advocate, testified that in these cases the IRS assigns new numbers to the two taxpayers who are filing under one Social Security number. Because of the confusing numbers, bureaucratic language and poor IRS communication, many taxpayers have difficulties overcoming identity theft, Olson said.

Sen. Ken Salazar, D-Colo., asked Shulman what the IRS intends to do to stop identity theft.

After apologizing to Spencer's client, Shulman said his agency walks a fine line between getting refunds out quickly and taking enough time to ensure that they go to the proper people.

The IRS will begin a new program focused on identity theft in the fall. The agency will train specialists, who would be able to resolve the types of issues Spencer and her client faced, Shulman said.

Salazar asked if the specialists would be available in person by phone, "as opposed to this land-of-no-response."

In the coming months, Shulman said, there will be a new Web site and an 800 number, where if "you say the word 'identity theft,' you'll be sent to a person trained to deal with identity-theft victims."

Some thefts may originate within the IRS.

Most IRS employees and contractors have daily access to taxpayers' personal information, inspector general George said, and know the system well enough to do more harm.

Employees work on laptops with sensitive data and regularly take the computers outside IRS offices, George said. He told the committee that the agency needs a unified data security plan.

Shulman agreed and said the new system will include a tracking process to mark cases as identity-theft cases.

Consequences to taxpayers of identity theft extend beyond the loss of a refund.

Olson said victims face annual problems proving their identity and are discouraged from fighting for the benefits they're owed. Some IRS help lines are toll numbers, which deters callers.

"Basically, the IRS needs to think of the taxpayer when designing these procedures," she said.


The IRS Web site has information about identity theft and tax fraud with links to local offices:

Source: scrippsnews.com

**********************************************************
For more info on IRS Scams See: Don't fall Victim to Bogus IRS E-mails or Telephone calls

April 14, 2008

Scam Alert: Beware of New Spam E-mail "Meeting Invite" -Don't Open

Meet the Meeting Invite Spam

Trend Micro recently issued a warning of a new type of spam, Meeting Invite spam.

In this latest attack, Nigerian scam spammers are using meeting invites to bypass anti-spam engines. The e-mail invites are personalized with a different link sent to each recipient and may be configured to send meeting alerts in order to draw increased attention to the spam message.

According to the Internet content security provider, it has been for the past 12 months tracking numerous formats but this is the first time the Google Calendaring system has been used as a mechanism. Spam filters may be designed to automatically filter out attachment spam or image spam, however they are less likely to be set up to track for this new delivery mechanism.

“We will most likely see this spam delivery method used for other types of spam—pump and dump, links to web threats, etc,” said Jamz Yaneza, research project manager at Trend Micro.

“It is likely that on the back of this first attack, we can expect to see such tools like Google calendar, further abused to contain malicious links and try to steal sensitive information.”

Trend Micro encourages all businesses and end users to demonstrate extra caution when receiving unexpected meeting invitations and other unexpected mail. On execution such attacks pose risks to recipients including the possibility of executing malicious code or other malware.

Already, Trend Micro has added this new type of spam to its spam blocking databases. For non-Trend Micro customers, the Company advises users to delete any similar meeting invite messages that might arrive in their inbox.


Source: SDA Asia Magazine

April 13, 2008

Another Day -Another Data Breach...

NYC hospital reports as many as 40,000 possible ID thefts

The Associated Press:
VERENA DOBNIK

NEW YORK - A man who worked in the admissions department at a prestigious Manhattan hospital has been charged with stealing and selling information on nearly 50,000 patients.

Dwight McPherson, 38, a former worker at New York-Presbyterian Hospital/Weill Cornell Medical Center, was arrested Friday night, shortly after the hospital announced the security breach.

McPherson was arraigned Saturday in federal court in Manhattan. He is charged with computer fraud, identity document fraud, transmission of stolen property and sale of stolen property. U.S. Magistrate Judge James C. Francis IV ordered McPherson not to leave the New York area before his next scheduled court appearance May 12.

Prosecutors said McPherson exploited his access to the hospital's computer registration system to acquire lists of patient names, phone numbers and Social Security numbers over a two-year period.

Authorities became aware that something was amiss when printouts of patient records were discovered in Atlanta during an investigation by postal inspectors, according to a complaint filed by prosecutors Saturday.

McPherson confessed to a role in the identity-theft scheme when he was interrogated by agents on Friday, an inspector said in the complaint.

McPherson told agents that in 2006 he was approached by someone offering money in exchange for the names, addresses and other identifying information of male patients born between 1950 and 1970.
The complaint said McPherson sold a batch of 1,000 records in December or January for $750, and another batch for $600 a short time later.

Prosecutors didn't reveal Saturday who had purchased the data or why, but the court complaint said the buyers intended to use the information "in connection with illegal activity."

McPherson didn't address the charges during his brief court appearance and wouldn't speak to reporters after he was released on bond.

"He is a hardworking, honest man," said his lawyer, Bob Walters.

New York-Presbyterian suspended McPherson in February after being contacted by federal investigators.

Hospital spokeswoman Myrna Manners said Friday evening that none of the stolen data contained private health information, and that the hospital was unaware of any instance where the information had been used to scam individual patients.

The hospital is in the process of contacting thousands of patients, setting up a hot line for them and offering credit monitoring services. It is also examining its procedures to prevent future thefts, Manners said.
******************************************************************************************
Take the time to safeguard your identity.

See: You may fiercely protect your personal information...But what happens when "others" don't?

************************************************************************

See why...
How much value do you place on your "free" time?

April 11, 2008

If F-R-E-E Spells 'Free" Why Does it Cost Money to Get That "Free" Credit Report?

I tried to get my free credit report and ended up buying credit monitoring services that I didn't want. Now I need to cancel. I went to the annualcreditreport site but think somehow I was misdirected. Why is it so hard to find the right place to get our credit reports for F-R-E-E?

Rob
Denver, CO

You are not alone. It is confusing when trying to figure out how to obtain the officially free annual credit report that we're all entitled to when there's an array of commercials filling the airways with jingles such as "F-R-E-E- Spells Free". What happened to you has happened to many consumers andunfortunately, it's a common complaint.

Another common problem is that if you happen to mis-spell the official site (annualcreditreport.com) even a tiny typo -you can be whisked away to an imposter site and may not realize it until after you have purchased a product or service.

"Jennifer of Washington, DC (03/18/08)
I had to get a credit report because Experian completely messed up my report. Unbeknownst to me I signed up for a 30-day free trial and have been charged $15 for the past four months. They claim that they have now canceled it, but they refused to refund the money.

I am planning to sue them in small claims court, but I am an attorney and realize that not everyone has the ability to do this. (For more complaints like this see: ConsumerAffairs)

Unfortunately there are no public service announcements directing consumers to the legitimate site -although mega advertising dollars are spent misdirecting consumers to sites where credit reports are only free once you pay for a service such as credit monitoring, and then and only then will you receive that F-R-E-E credit report!

To obtain your free credit report without paying for a service or product:

1. Call 877-322-8228 and order it over the phone - This is the preferred method because the privacy policy for phone orders is much better than the one for ordering over the internet.

2. Visit the AnnualCreditReport.com website - This will give you immediate access to your credit report but there are certain privacy risks. We suggest that you read their privacy policy in its entirety before ordering this way. If you are asked for your credit card number -back out and start over -or better yet, use the toll free number above.

April 09, 2008

Safeguarding your Identity and Your Computer From Hackers Continues to be a Challenge

Hackers infiltrate search engines, social networks

SAN FRANCISCO — Consumers who use search engines, online social networks, browsers and the like face a gantlet of viruses and malicious software code, according to a cybersecurity report from Symantec, issued Tuesday as security experts gather here for the sprawling RSA Conference on tech security.

The repercussions go beyond the loss of personal data, security experts say. As more consumers are victimized, it could undercut their confidence in legitimate websites, says Billy Hoffman, manager of Hewlett-Packard Security Labs.

Previously, hackers were more likely to use e-mail with attachments to steer victims to virus-tainted websites. Now, they are implanting their links on legitimate websites. MORE

******************************************************************
Anti-virus software isn't the only computer security tool

Mike Saign smelled something fishy about the e-mail he received — purportedly from an eBay auctioneer — accepting his lowball offer for a high-end golf club.

The sender claimed his PayPal account was down and asked Saign to wire payment to him via Western Union. Instead, Saign, 25, downloaded Iconix e-mail ID, a free tool that pegged the e-mail as a fake.

Saved from being scammed, Saign, a real estate adviser, disabled Iconix and hasn't used it since. "I feel like the security software in a normal computer keeps you away from most bad things," he says.

That's not necessarily so. Fraudulent e-mail and tainted websites are more prevalent than ever. Spam, much of it pitching fake drugs and financial scams, accounts for 80% of all e-mail, says Symantec. The number of new strains of malicious programs increased fivefold in 2007 over 2006, and about 20,000 new malicious programs are unleashed on the Web each day, says AV-Test Labs.

Source: USA Today

******************************************************************
See Prior Blog ...

Protect your computer from hackers -before it's too late.

Over the last year, I suffered two window system crashes and found myself combating numerous viruses and PC attacks. It seemed that no-matter what I did, or how often I updated my virus protection software and made sure my firewalls were active, I would wake up morning after morning to find another intrusive virus of some sort had managed to land in my life –and my computer. MORE

******************************************************
See earlier blog for tips to protect yourself on social networking sites & steps to help protect your identity...

Students Beware! Identity thieves are studying you!


April 08, 2008

April Brings in More Than Showers...Newly Discovered Data Breaches...

Personal Pfizer Data on Stolen Laptop

Pfizer Inc. has revealed that the theft of a laptop computer in February potentially exposed about 800 current and former employees and contractors to identity theft.

“At this time, Pfizer is not aware that any person has inappropriately used any exposed information, but the company is continuing to monitor the situation,” Pfizer attorney Bernard Nash said in a letter to attorneys general in several states, including Connecticut.

Nash’s letter, dated March 19, said a laptop was stolen Feb. 7 by a burglar from the home of a contractor who helps arrange planning travel and meetings for Pfizer. The laptop was password protected, Nash added.
Information on the laptop included names, credit card numbers and, in some instances, credit card expiration dates, various addresses and phone numbers, hotel loyalty program numbers and other information. It did not appear that any Social Security numbers or PIN codes were exposed, the company said.

Last year, a series of four data breaches at Pfizer exposed the names and personal information of more than 52,000 people.


*************************************************************
ID theft hits 93 students at UC Irvine

Up to 7,000 could be at risk from phony tax return filings.


UC Irvine police say 7,000 current or former graduate students could be at risk of identity thieves who already used stolen data to file fake tax returns for 93 students.

Police said Friday they don't know how the information was stolen or who is using it.

Only grad students reported being targeted in the UCI case – the latest in a series of campus security breaches nationwide that led to a state law banning use of Social Security numbers as student identification.

In 2006, UCLA notified 800,000 people that their data might have been hijacked.

Most of the 93 UCI students discovered the thefts when they tried to file electronic tax returns and were told by the IRS that their returns had already been filed, officials said.

"For the last two weeks, we have been scouring all of our databases and computer systems, but we have not found any leak here" on campus, UCI Police Chief Paul Henisey said. MORE

*******************************************************************
Web hacker gains credit card data at Okemo


Okemo Mountain Resort is the latest target of an Internet thief who gained access to customer credit card information.

The Ludlow ski area announced Monday that its computer network was breached in February by an intruder who gained "potential access to credit card data including cardholder names, account numbers and expiration dates," Okemo said in a statement.

Okemo spokeswoman Bonnie MacPherson said Monday the company has not heard of any customers subjected to fraud as a result of the breach.

"We are not aware of any and that's part of why this announcement is being made, to make people aware so they'll take precautions since we just completed this forensic investigation and review," MacPherson said. "We now feel we are fully informed so we could go public with this."

The data breach occurred during a 16-day period between Feb. 7 and Feb. 22, involving 28,168 card transactions. Okemo noted that the actual number of credit card holders is likely smaller because of multiple transactions.

MacPherson said the company learned of the data breach at the end of February. She declined to say how the resort became aware that its computer system had been compromised.

She said the data breach could also potentially affect debit card holders if they used their card as a credit card. The incident affects customers in any number of states and foreign countries who used their credit cards at Okemo during the above time periods, MacPherson said.

Okemo officials said they hired a data security and forensics expert who also determined that credit cards used between January and March 2006 were compromised as well. The latter involved as many as 18,401 individual credit cards. MacPherson said many of those cards had expired.

She also said the data break-in was isolated to Okemo and did not involve customer credit cards used at its two other resorts, Mount Sunapee in New Hampshire or Crested Butte in Colorado.

MacPherson said the resort notified the Vermont Attorney General's Office, VISA, MasterCard and American Express of the data breach. She said federal law enforcement and regulatory agencies are also involved.

"As a result of this, we've increased the firewall capability and added some software and taken some additional precautions," she said.

It's the second high-profile data breach in New England involving credit or debit card numbers. Maine-based Hannaford supermarkets announced last month that 4.2 million credit and debit card numbers were compromised. There have been at least 1,800 reported cases of fraud associated with that data theft. MORE

April 07, 2008

Experian to Track Net Users Activity

EXPERIAN, the credit checking company, is braving mounting concerns over internet privacy with plans to launch a service that will track broadband users’ activity so they can be targeted with advertising.

Through Hitwise, the web-site company it acquired for £120m a year ago, Experian has held talks with internet service providers to sell its monitoring technology.

Observers expect it to compete in part with Phorm, an AIM-listed company that has stirred controversy after being recruited by BT, TalkTalk and Virgin Media to track their 10m customers’ behaviour so they can be sent advertising messages on the websites they are looking at.

However, the key difference is that Hitwise, which describes itself as an “online competitive intelligence service” would play little part in dispatching the advertising to web pages itself, something that Phorm does through its Open Internet Exchange.

“Hitwise is not in the online behavioural targeting business,” a spokesman said.

Phorm’s shares have tumbled 36% since it unveiled its three key clients in February, partly because of a £32m fund-raising for overseas expansion.

Last week, BT was drawn into the privacy row when it admitted to carrying out secret trials of the Phorm technology in late 2006. Jonathan Groo-cock, an analyst at Investec, thinks a revenue sharing model could bring in an extra £85m of sales to BT.

Another trial to be carried out shortly by the two companies will be monitored by the Information Commissioner’s Office, which said: “Clearly the trial should reveal whether this is a service that web users want, whether it is privacy friendly and that users are comfortable with the privacy safeguards put in place by Phorm.”

Kent Ertugrul, Phorm’s chief executive, insists that it tracks users anonymously, replacing their identities with random numbers that are dropped once an ad has been sent. Unlike “cookies” dispatched by many websites to track behaviour, it can also be switched off.

The company has recruited a heavyweight board, including David Dorman, the former boss of AT&T and Christopher Lawrence, the vice-chairman of Rothschild.

Experian, once part of GUS, is best known for trawling public records and selling the data to banks and retailers.

Source: Times Online UK Sunday Times

April 03, 2008

LifeLock Plans To Defend Their Name –and ours!

An Exclusive interview with Todd Davis, CEO of LifeLock

April 2, 2008– Over the past 30 days, LifeLock has been hit with three separate lawsuits over the company’s identity theft prevention service. The first suit was filed by Experian; claiming that LifeLock is violating the Fair Credit Reporting Act and costing Experian money by filing fraud alerts for LifeLock’s customers every 90 days. The two consumer suits claim that LifeLock’s guarantees to protect consumers are riddled with fine print and misleading. In an exclusive interview, LifeLock’s CEO Todd Davis told us that he is ready for these fights and he set the record straight about the company’s service offerings, including upcoming product launches and its growing place in the market.

The Experian law suit (which we have previously reported on) appears to hinge on language within the FCRA which states that consumers must have a reasonable expectation that they could become victims of fraud or identity theft. In addition, Experian is claiming that LifeLock is using fraud alerts in ways never intended by Congress.

The two consumer lawsuits take aim at LifeLock’s $1 million guarantee. The consumers filing the suits claim that it is misleading and that the guarantee only covers problems caused by the failure of LifeLock’s service. They are saying that it is essentially worthless. But that doesn’t appear to be what more than 800,000 subscribers think.

Although Davis wouldn’t specifically comment on any of the law suits, our conversation did cover FCRA issues as well as consumer issues included in the suits. With regard to the FCRA, Davis told us that when customers sign-up for LifeLock, they are required to provide a specific reason – such as being notified that their personal data was leaked in a data breach – that they need LifeLock’s services. Any customer that refuses to provide such a reason will be turned down for service. This certainly sounds like it complies with the FCRA's “good faith” language. If so, LifeLock is using fraud alerts in the way that Congress intended when it passed the law.

When asked about the company’s $1 million guarantee, Davis said that the purpose of it was to make sure that if any of the company’s customers experience any type of fraud or identity theft while subscribing to LifeLock, the company will work to restore their credit and make them whole financially. The guarantee includes hiring outside resources as necessary to assist in fixing any credit problems that have occurred and to put the criminals responsible in jail.

Davis pointed out “the company now has more than 870,000 customers and that by the FTC’s statistics, more than 29,000 of them should have been victims of fraud or identity theft. In the history of LifeLock, only 71 of the company’s customers have had to invoke the guarantee.” This certainly would indicate that LifeLock is extremely effective at putting the brakes on identity theft before it occurs.

LifeLock intends to fight all three of the law suits vigorously. Davis did say that the company has access to a variety of great resources to help them in this fight and that the company’s investors remain steadfastly supportive. It’s interesting to note that just today; The Identity Theft Research Center released a report indicating that data breaches more than doubled in the first quarter of 2008. That information alone is alarming and enough to make one fear they are in imminent danger of becoming an identity theft victim.

Denise Richardson, Board Member of ACCESSGiveMeBackMyCredit.com
Jim Malmberg, Executive DirectorACCESS