There's just nothing more I can say about this so I'll stick with pointing you to the news articles and just shut up.
On second thought, here's an interesting article stating that they knew about the breach since last May!
SAIC spokespeople said that several employees were placed on leave after the incident was disclosed, and that it contracted data security company Kroll Inc. to provide free identity theft protection for all affected individuals for one year.
This is so, so stupid. It's not weak security, its that you data-abused us for all our customer data that we didn't want you to keep anyway. If you hadn't stored all the data on us, you couldn't have lost it.
In addition to pilfering over 45 million—and possibly as many as 200 million—credit card and debit card numbers, the hackers were also able to obtain other personal data from over 450,000 customers. This included driver's license numbers and Social Security numbers.
I already know they don't need to store our credit cards, but licenses and SSNs?
Tags: Data Breaches, Identity Theft, TJX
On April 23rd, the ID Theft Task Force that's chaired by Alberto Gonzales (the US Attorney General) and co chaired by Deborah Platt Majores (the chairwoman of the FTC) has released their final recommendations for reducing identity theft.
Here are a few of their better recommendations:
set forth the factors that should be considered in deciding whether, how, and when to inform affected individuals of the loss of personal data that can contribute to identity theft, and whether to offer services such as free credit monitoring to the persons affected.
For residents of states in which state law authorizes a credit freeze, consider placing a credit freeze on their credit file.7 This option is most useful when the breach includes information that can be used to open a new account, such as SSNs. A credit freeze cuts off third party access to a consumer’s credit report, thereby effectively preventing the issuance of new credit in the consumer’s name.Among the state-enacted remedies without a federal counterpart is one granting consumers the right to obtain a credit freeze. Credit freezes make a consumer’s credit report inaccessible when, for example, an identity thief attempts to open an account in the victim’s name. State laws differ in several respects, including whether all consumers can obtain a freeze or only identity theft victims; whether credit reporting agencies can charge the consumer for unfreezing a file (which would be necessary when applying for credit); and the time allowed to the credit reporting agencies to unfreeze a file. These provisions are relatively new, and there is no "track record" to show how effective they are, what costs they may impose on consumers and businesses, and what features are most beneficial to consumers. An assessment of how these measures have been implemented and how effective they have been would help policy makers in considering whether a federal credit freeze law would be appropriate. Accordingly, the Task Force recommends that the FTC, with support from the Task Force member agencies, assess the impact and effectiveness of credit freeze laws, and report on the results in the first quarter of 2008.This is very weak and isn't even a recommendation of it's own, just a sub-component of "Assess Efficacy of Tools Available to Victims". So it went from the nice, solid (and correctly worded) "effectively preventing the issuance of new credit in the consumer’s name" to "there is no 'track record' to show how effective they are, what costs they may impose on consumers and businesses, and what features are most beneficial to consumers". Alberto Gonzales and Deborah Platt Majores should be ashamed of themselves for putting their names on this worthless report.
It looks like the credit reporting companies are starting to read the bones and pre-emptively offer credit freezes before they get legislated into having to provide it on worse terms and lower fees. Two out of three have jumped onto the bandwagon with only one holding out so far.
Tags: Accountability, FTC, Identity Theft, Utter FailureIf you want to learn more about my professional background, click here to learn more.
Check out one of my guides/tutorials:
| To understand what makes a good password, let's talk about what makes a bad one first. |
| Making good passwords can be complex, but here are some tips and tricks that will make it easier. |
| Once you've taken the trouble to make a good password, the next step is to keep it safe! |
| Now that you've done all this work, you have to learn the most important rule of all: DON'T GIVE THEM AWAY! |
... or check out any of my other guides and tutorials by clicking here!
| Copyright © by Jeremy Duffy All rights reserved. | About Me and This Site | Blog | Contact | Policies | My LinkedIn | My Youtube Channel |
To understand what makes good passwords, first check out some of the worst passwords out there and what makes them so bad.
[Click for full description]It's impossible to expect someone to make good passwords by just giving them some rules. There are tricks that make your passwords secure and easy for you all at the same time.
[Click for full description]It's really a skill to come up with secure passwords that you can remember. Once you've learned how, remember that it doesn't matter how good you are if you don't protect your password properly.
[Click for full description]A disturbing new practice among websites and services is where they ask you for your user name and password to other sites. I call this "Password Mugging"
[Click for full description]
