 Costly Privacy Breaches in 2009
Network security failures have led to some of the largest breaches of private financial and personal data in 2009.
 Heartland Payment Systems reached a settlement with American Express for $3.6 million after a security breach revealed 130 million credit and debit card numbers, affecting nearly 4.2 million people. Several class action lawsuits are currently pending.
- Although Heartland Payment Systems exposed private financial data for American Express customers that resulted in a multi-million dollar settlement, American Express faced its own privacy breach in Phoenix, Arizona. A company employee enabled accomplices to withdraw more than $1 million by supplying PIN numbers, account information, and credit and debit card numbers.
- In 2008, a Countrywide Financial employee copied data onto a flash drive with the intention of selling nearly 2 million customer records. One year later, after Bank of America acquired Countrywide, it discovered a man posing as an Air Force reservist had obtained thousands of account numbers, resulting in a loss of $500,000.
- One of the top security breaches did not result from hacking, but rather the implementation of a skimming device on ATMs. Chase Bank discovered a skimmer had been placed on ATMs, recording the magnetic strip information and taking small amounts of money from customer accounts, totaling nearly $1.8 million.
- RBS Worldpay experienced a similar breach after hackers obtained financial data and cloned ATM cards, stealing nearly $9 million from more than 130 ATMs.
- An unknown source managed to obtain and sell Capitol One Bank’s customer information online. Using counterfeit cards, and customer information, the crime ring collected more than $650,000 from ATMs in Minnesota.
- Accounting departments should carefully scrutinize employee payrolls after PayChoice, a payroll processing company, was alerted that their system had been compromised after customers reported that fake employee names appeared on their payrolls. The extent of financial information is not currently known.
- The Bank of New York Mellon learned that employee information should be protected from hackers and theft. A man used more than 150 identities of bank employees to take $1.1 million. The theft targeted charities, non-profit organizations, and other entities.
- Internet services providers should take heed from the beach at Network Solutions, where a code implanted on the company’s web servers tracked and copied financial information from hosted online stores. Nearly 573,000 credit and debit card accounts were compromised.
Companies should work with counsel and other qualified consultants to take extra precautions to protect web servers and restrict employee access to private personal and financial data to prevent cybercrime. |