Sure it is. That's why the names, addresses, Social Security Numbers, credit card numbers and credit card expiration dates of some 300,000 clients was neatly packed in a backpack in the back of a "locked" car in San Francisco. I guess someone exercised some degree of care—I mean the car might have been left unlocked.
The letter goes on to say:
"CBR also brought in computer security experts to evaluate potential risks. Our experts have advised us there is no indication that any of your personal information has been accessed or misused."
It should really read, "… no indication that your personal information has been accessed or misused yet." The information is out there. It's been in the press. Rest assured, somewhere out there identity thieves are making inquiries.
But the best is yet to come. The Big Payback I've read a lot of breach notification letters like this one, and the following line has to be one of my favorite passages from any of them:
"Although we do not believe this situation will involve identity theft out of concern and caution we have developed a plan to provide you with additional protection and peace of mind."
CBR then offers a one-year membership in the Experian Triple Alert program.
Whew. Now that's a relief. You are relieved, aren't you? CBR is banking on the fact that because a computer and other property were stolen from the car, the tapes were not the target of the theft.
Why am I not hearing a collective sigh of relief?
Is there no one willing to jump on the "relief" train?
[Resource: Identity Theft Emergency]
"What happens after one year?" says Ondrej Krehel, Information Security Officer at Identity Theft 911, a Credit.com sister company. "Once our Social Security number is somewhere out there, it could be hard to prevent ID theft in the future."
Identities are currency. They are evergreen. Like fine wine they get better with age. The most sophisticated identity thieves understand that oftentimes banking identities leads to greater return than simply running about the countryside opening accounts within days of a breach. Please do not underestimate the fact that once someone with ill intentions gains access to your identity they have an option on your life. The question then becomes "when" and not "if" he or she chooses to exercise that option.
Sorry! "We very much regret that this situation occurred," the letter says.
And I am sure they do. I'm just not so sure that when a CBR client suffers a personal identity theft incident that CBR's regret will be of great comfort to them.
Look, I believe that CBR does important work and have no doubt that they really are horrified by what happened here. I've been tough on them in this column, but in truth they are far from alone. They are simply another Flavor of the Month. Recently, Health Net suffered a data breach involving potentially 1.9 million current and past customers, health care providers and employees. Health Net's woes represented its second breach incident in 2 years. In 2009, they reported that a hard drive containing financial and medical information on 1.5 million customers had gone astray. This time several servers at a Health Net data center operated by IBM went walkabout. Forgive my disbelief, but how does one lose several servers? Needless to say, several federal and state regulatory authorities—not to mention a fleet load of their clients—were less than amused.