Ohio: Stolen device contains 859,800 IDs

[TeamCasey]

http://www.msnbc.msn.com/id/19724250/

Ohio: Stolen device contains 859,800 IDs
Including info on those who had not cashed state income refund checks
The Associated Press
Updated: 7:02 a.m. ET July 12, 2007

COLUMBUS, Ohio - A stolen computer storage device contained more than twice the number of taxpayers' identifications than had been previously reported, Gov. Ted Strickland said Wednesday, but he emphasized there is still no indication the data have been compromised.

The names and Social Security numbers of 561,126 people who had not cashed state income refund checks were on the device, as well as 14,874 people who did business with the state, according to an ongoing review of the information it held.

That brings the total number of taxpayers affected to 859,800, Strickland said.

The device was stolen June 10 from an intern's unlocked car.

Strickland said no ID theft cases linked to the stolen device have been reported, and that extracting data from it would require a high degree of knowledge and specialized equipment.

In addition to the refund check recipients, others whose information was on the device include state employees, welfare recipients and lottery winners who have yet to cash their tickets.

Strickland noted that the estimate of affected people may include duplicates because some people may belong to more than one of the groups whose information was on the device.

[dabvu2498]

Why would an intern have that device in his/her car?

[Roy Tucker]

Why would an intern have that device in his/her car?

The bigger question is why is this data outside of a secure data canter. Irresponsible data protection policies IMO.

Something tells me the intern won't get a job out of this. Hopefully it's just a smash and grab theft and don't realize what they have.

For us in the computer storage biz, these are things that cause CEOs and CTOs to lose sleep.

[dabvu2498]

Something tells me the intern won't get a job out of this.

Sounds like a perfect candidate for US Congress.

Sorry... I keed, I keed.

[westofyou]

The bigger question is why is this data outside of a secure data canter. Irresponsible data protection policies IMO.

Lots of idiots out there with your info.

Case in point I have a client who runs a online store and a giant warehouse for RV Parts. The guy refuses to protect the CC Info in the client files and just tried yesterday to get me to get rid of the Terms of Service checkoff at the final point of sale task. He said some folks had complained that it was annoying.

I told him that once they checked it then they only had certain recourses to sue him if something came up, otherwise they could *not* complain about it to him and then he'd be open to almost any sort of lawsuit involving a sale issue.

He decided that they could complain.

[Heath]

Thank goodness for direct deposit.

[RedsFan75]

Remind me not to do business with him!!!

We have to have all our devices encrypted, that's any external drives, even the flash or thumb drives.

[OesterPoster]

Remind me not to do business with him!!!

We have to have all our devices encrypted, that's any external drives, even the flash or thumb drives.

Which is why I'm not losing any sleep over this backup tape theft. There are too many things which would have to line up perfectly for anyone to get valid data off the tape.

1.) Correct type of tape drive.
2.) Match of the backup software used to backup the data.
3.) Most backup software encrypts the data, so you'd need to decode or un-encrypt the stuff.
4.) Then you'll have a database. What kind of database? ADP? Proprietary? Oracle?
5.) So then let's say you actually have the database. How do you open the database and find SSN information and whatever inside the database?

I'm not saying it can't be done, but it's highly unlikely someone can jump through all the necessary hoops to view personal data in this particular case.

[Roy Tucker]

I'm not saying it can't be done, but it's highly unlikely someone can jump through all the necessary hoops to view personal data in this particular case.

I understand what you're saying and it's probably true in this case, but security through obfuscation is not a valid policy, i.e. you're playing with fire.

You might come up against an experienced IT-hacker-type that do all the stuff you listed above in their sleep that also has a grudge against the state.

[dabvu2498]

Thank goodness for direct deposit.

So how well do you think the state govt. is guarding your checking account number?

[Ltlabner]

This is all back-seat driving. But assuming this is your typical smash and grab, doesn't announcing to the world that all of this data was stolen clue the typically not-so-brilliant theif in that maybe he should check out that thumbdrive. Whereas without the media blitz he/she would likely not even realize what it is they have.

Of course, I guess the state is obligated to inform people.

[RedsFan75]

Of course, I guess the state is obligated to inform people.

Yes and even with the Media blitz, it still wasn't fun when I got the letter telling my my information was among the info that was on the Veterans database that was stolen.

[Roy Tucker]

This is all back-seat driving. But assuming this is your typical smash and grab, doesn't announcing to the world that all of this data was stolen clue the typically not-so-brilliant theif in that maybe he should check out that thumbdrive. Whereas without the media blitz he/she would likely not even realize what it is they have.

Of course, I guess the state is obligated to inform people.

The only thing worse than losing the data is hiding the fact they lost the data. You'll *really* get your hoo-ha caught in a wringer for that.

The article didn't say what kind of storage device it was (although the options are fairly limited).