Another Data Breach, Another Thin Attempt to Make Us Feel Safe
When Merrill Lynch (NYSE: MER) told employees last week that a computer device containing personal data about them had been stolen from its New Jersey office, the brokerage did like many, many companies before it. Merrill said, in essence, "But don't worry about it."
"We have no reason to believe at this point that anyone has accessed the protected information," a company spokesman told me this week. He wouldn't say how many people may be affected, though CNBC reported it's 33,000 and among the personal information now compromised are Social Security numbers.
Why doesn't Merrill have a reason to believe the data has been accessed? The spokesman declined to explain.
Did it analyze network logs for signs of unauthorized access that could be tied to the stolen information? Did it recover the stolen device and test it, however imperfect those tests actually are, to unearth the thief's digital tracks while he had the device? Did the company contact all the financial institutions used by the affected employee to analyze any unusual account activity?
Did Merrill gaze into its Magic 8-Ball to ask, "Did a dastardly ne'er do-well use our employees' data for evil?" (Shake, shake, shake.) Answer revealed: "My sources say no."
Merrill isn't the first company, and won't be the last, to simultaneously acknowledge a data breach and assure that the information hasn't been compromised. Pfizer did it in May when it notified New Hampshire authorities that data on 17,000 current and former employees was made vulnerable when the spouse of one employee downloaded file-sharing software onto a Pfizer laptop. Caterpillar said it in April when it said a company laptop was stolen, containing employee data. Neiman Marcus, Boeing and Starbucks have all said it. Both Privacy Rights Clearinghouse and attrition.org keep careful track of data breaches and companies' responses to them.
But the truth is that by virtue of the information being stolen, it's been compromised. And no one can really know what happens to those Social Security numbers, names, addresses, account numbers, medical records and whatever else has been exposed in various breaches until months or years later -- after it's bought and sold and bought and sold again, and perhaps used to set up fake identities. Crime takes time.
Merrill, which is working with New
Print
"We have no reason to believe at this point that anyone has accessed the protected information," a company spokesman told me this week. He wouldn't say how many people may be affected, though CNBC reported it's 33,000 and among the personal information now compromised are Social Security numbers.
Why doesn't Merrill have a reason to believe the data has been accessed? The spokesman declined to explain.
Did it analyze network logs for signs of unauthorized access that could be tied to the stolen information? Did it recover the stolen device and test it, however imperfect those tests actually are, to unearth the thief's digital tracks while he had the device? Did the company contact all the financial institutions used by the affected employee to analyze any unusual account activity?
Did Merrill gaze into its Magic 8-Ball to ask, "Did a dastardly ne'er do-well use our employees' data for evil?" (Shake, shake, shake.) Answer revealed: "My sources say no."
Merrill isn't the first company, and won't be the last, to simultaneously acknowledge a data breach and assure that the information hasn't been compromised. Pfizer did it in May when it notified New Hampshire authorities that data on 17,000 current and former employees was made vulnerable when the spouse of one employee downloaded file-sharing software onto a Pfizer laptop. Caterpillar said it in April when it said a company laptop was stolen, containing employee data. Neiman Marcus, Boeing and Starbucks have all said it. Both Privacy Rights Clearinghouse and attrition.org keep careful track of data breaches and companies' responses to them.
But the truth is that by virtue of the information being stolen, it's been compromised. And no one can really know what happens to those Social Security numbers, names, addresses, account numbers, medical records and whatever else has been exposed in various breaches until months or years later -- after it's bought and sold and bought and sold again, and perhaps used to set up fake identities. Crime takes time.
Merrill, which is working with New
Previous Post: Nardelli as New Chrysler CEO and What it Means for Chrysler's ITNext Post: Let's Start Getting E-Discovery Right
Most Discussed Posts
Cloud computing has emerged as one of the most significant game changers to hit the technology landscape in the past 20 years. With this massive expansion of the cloud, the perception of the IT organization is shifting from a utility player to a change agent. This eBook breaks down five ways progressive organizations are using cloud-based IT Management solutions to help drive innovation and become more strategic, including: adding visibility and analytics, speeding up time-to-value, lowering costs, improving prioritization, and providing a blueprint for future cloud deployments.
Read the white paper to see how IBM helped Citigroup deliver new services and enhancements to their 200 million customers faster.
There are 3 ways to modernize legacy applications: rewrite completely, acquire packaged solutions or migrate existing code. This paper explains why it's best to migrate and how IBM® Rational® software can help.
Accommodating specific lines of business can result in a hybrid ecosystem of applications and servers. The resulting complexity of this architecture makes for an environment that is costly to maintain and difficult to change when addressing new challenges.
This whitepaper will help you to define a mobile device passcode policy. Security managers must attempt to reconcile two opposing goals. They must: 1) create a passcode policy that is strong enough to protect the device if it is lost or stolen, while: 2) not annoying users with needless length or complexity.
This whitepaper, authored by The Radicati Group, looks at the key reasons organizations should consider moving to a cloud-based archiving solution. Email archiving solutions enable organizations to store, monitor, and collect electronic data exchanged by their users to comply with internal policies and regulations.
ATERNITY will showcase a 30-minute demo on how Fortune 500 companies are leveraging its award-winning FPI Platform to deliver a user-centric approach to Proactive IT Management.
For businesses to move forward and tap into the ever-expanding universe of Internet users and network-enabled devices, it's critical to learn how to make the transition to IPv6. Learn the critical steps your organization must take to make a seamless transition-and keep your business world connected.
Learn how IT teams can protect against spear phishing tactics. Harry Sverdlove, chief technology officer of Bit9 offers a frank discussion about spear phishing - the most common technique used in today's advanced attacks.
Learn how to build a solid business case for your migration to Red Hat Enterprise Linux so you can run leaner, innovate faster, be more flexible and own the New Now.
Social media isn't about you; it's about everything around you. As you consider how your customers want to communicate with you, social media is something that can't be ignored. But what should your strategy be? Is social media "just another channel?" What kind of a plan makes sense for your contact center and for your customers? Join our experts as they share their insight and research results.
Hardware tokens were a popular method of strong authentication in past years but the cumbersome provisioning and distribution tasks, high support requirements and replacement costs have limited their growth. The additional log-in steps that hardware tokens require and the resulting user frustrations have limited adoption and make them impractical for larger scale partner and customer applications.
Sponsored Links
