Data Loss News

Seventy-seven patients had their Social Security numbers stolen and used for fraudulent tax returns. Patient names and possibly addresses, dates of birth, clinic numbers, limited health information and health insurance companies were exposed. Patients who were seen in orthopaedics between May of 2008 and January of 2009 for something other than physical therapy were affected.

A donor database may have been breached. It would have revealed phone numbers and email addresses. It appears that one or more disgruntled organization insiders distributed a libelous letter to people who had their information on the donor database. Several of these people reported receiving the letter.

A suspect was arrested and charged with fraudulent use of a credit card. The suspect is associated with three businesses and investigators are checking to see if customers of those businesses were victims of fraud. Several card skimmers were recovered at the three businesses.

Those with questions can call Day’s at (800) 439-3297.

A number of Maine residents have experienced credit, bank account and credit union fraud after shopping at Day’s Jewelers.  An investigation has revealed that a hacking incident caused the breach and the approximate time of the breach.

Backup tapes were stolen from an unsecured and unlocked van during transport by GRM Information Management Services.  The theft occurred during December of 2010.  The information on the tapes was from patients, staff members and associated employees and dated back to 1991.  Names, Social Security numbers, addresses, patient health information and other patient and employee information may have been exposed.

An outsider with a thumb drive that contained confidential payroll information contacted the agency on January 27. The thumb drive contained payroll reports with the information of around 550 staff members. Pay stub data with names, Social Security numbers and other payroll information were exposed. People employed at Warner Creek between July 31, 2005 and September 30, 2007 had their Social Security numbers exposed. People employed by Deer Ridge between August 31, 2006 and September 30, 2007 had their Social Security numbers exposed. People employed at Warner Creek, Shutter Creek and Deer Ridge between October 1, 2007 and the time of the breach had personal information other than Social Security numbers exposed. The drive was damaged before being returned to the department and it is unclear what, if any, additional types of information may have been exposed.

http://www.ftc.gov/opa/2011/02/settlement.shtm

Three companies who resell consumer credit reports have agreed to settle with the FTC over charges that computer hackers could easily access consumer data through their weak information security systems.  Hackers accessed more than 1,800 credit reports via security flaws in the computer networks used by the companies’ clients.

UPDATE (2/13/11): At least 100 East Carolina University students have reported fraudulent charges to their accounts.  The breach is believed to have occurred between January 5 and 25.

A device with protected health information of patients was stolen on or around November 17, 2010.

A computer that contained the protected health information of patients was stolen on or around November 18, 2010.

A portable electronic device was lost or stolen on or around November 22, 2010. It contained the PHI of patients.

The loss of a back-up computer disc with patient information was confirmed on April 22, 2010.  The disc contained laboratory chemistry exam results.  Patients who were treated at the Hospital’s lab between July 2008 an February 2010 were affected.

UPDATE (2/3/2011): Names, Social Security numbers, dates of birth, home addresses, account numbers, and health care services and related diagnostic codes may have also been exposed.

UPDATE (2/3/2011): It appears that three workers will be fired and two will be suspended because they inappropriately accessed football player information.

UPDATE (2/7/2011): One of the fired workers is challenging allegations that she viewed patient information without authorization.  She and her representative claim that she did nothing wrong, and that if the accusations were true, viewing computerized medical records for a few seconds should be treated as a minor infraction.

A company laptop that contained the personal information of current and former KBR employees and contractors was stolen. Names, Social Security numbers, addresses, dates of birth and employee ID numbers may have been accessed.

A backup tape was stolen from an employee’s car sometime around November 23.  The device was used for storing copies of paper records.  Patients may have had their names, Social Security numbers, insurance details, driver’s license information, immunization records, medical history forms, previous doctor records and patient medical records scanned and placed on the backup tape.

Three people were arrested for tampering with ATMs and making fraudulent charges on customer cards.  They allegedly accomplished this by placing small cameras and card readers on at least two ATMs in the San Luis Obispo area. Over 100 people discovered that fraudulent charges had been made on their cards. Investigators first became aware of the situation on January 13.

Backup tapes with information from Ophthalmology department equipment were stolen from Abbott’s office after being collected from Baylor. The information on the tapes included the eye contour measurement charts, names and physician names of patients who were preparing for Lasik surgery.

The November 12 theft of a physician’s laptop resulted in the exposure of client information.  The information included full name and billing information, but did not include addresses or Social Security numbers.  Azure Acres is a drug and alcohol abuse facility.

A BCBSM website created by Tstream was the source of a breach.  A BCBSM found her personal information online when searching her name.  People applying for individual health insurance between 2006 and an unclear date had their names, Social Security numbers, addresses and dates of birth exposed. BCBSM was notified of the error on November 17, 2010.  The information was accessible for an unspecified amount of time. Though 6,500 BCBSM members were notified, only 2,979 were affected.

In November, Saint Vincent officials learned that several associate email accounts had been breached. A third party managed to obtain email logins. Patient names, dates of service and clinical information may have been accessed.

A computer server that contained brain scan and other patient studies was hacked sometime around September 15. Patient names, dates of birth, ages, genders, medical record numbers and doctors’ names were exposed. The breach was discovered on November 11 during routine monitoring of computer network backups. The server was removed from service and a firm was hired to investigate the issue.

On November 12, Seacoast discovered that a server had been breached. Patient names, Social Security numbers, addresses, phone numbers and other personal information may have been exposed by the breach. Credit card and other financial information were not exposed. The estimated number of individuals who received notification is 231,400.  Not all people who received a notification letter were affected.  Patients and people serving as insurance guarantors were affected. It is believed that the hackers were utilizing Seacoast’s bandwidth to play a popular game called Call of Duty: Black Ops.

UPDATE (1/31/11): Some people who were affected by the breach have recently reported fraudulent charges.

UPDATE (2/19/11): Additional details reveal the exact number of names that were on the customer database, the fact that the perpetrator used an administrative password, and the fact that Fandotech, the company that was hosting and managing the site, was not following correct web security procedures.

Authorities investigating fraudulent debit and credit card charges discovered a skimming device inside of a gas pump. Only one pump at the station was found to have a skimming device. Gas station employees first learned about the possible existence of a skimmer at their store in December.

Someone discovered sensitive information on the government website. Some Social Security numbers and bank account numbers were viewable. Records entered after and around 2002 are carefully checked for Social Security numbers and bank accounts, but some records prior to that time still contain sensitive information. The clerk’s office removed sensitive information from several records after being notified of the problem.

An employee error caused sensitive patient documents to be sent to a recycling facility. Some of the documents, which should have been shredded instead of recycled, were found on December 29 after being blown out of a recycling truck.  The documents included patient names and dates of birth.  The papers that fell off the truck were shredded by Adventist and any documents that remained at the facility were destroyed there.  The employee responsible for the mistake was not fired.

On November 5, several out-of-service computers were determined to be missing from a storage facility.  An investigation revealed that a dishonest employee had stolen the computers, attempted to clear the hard drives and was in the process of reselling them.  Information from patients treated at Grant between 2008 and November 5 of 2010 may have remained on the stolen computers.

UPDATE (1/14/11): The breach affected 501 individuals.

A steel cabinet was discovered missing on November 18.  The cabinet had a safe which contained IT data and software backup tapes.  Personal information on the backup tapes included names, Social Security numbers, addresses, financial account numbers, driver’s license numbers, medical information and other personal information.  The cabinet was most likely thrown out during a cleaning.  If so, the cabinet and its contents would have been taken to a transfer station, crushed, and then transported to a landfill for further destruction and disposal.

Pinnacle became aware that outpatient information may have been accessed through an independent medical transcription company. Gair provides transcription services for Pinnacle and may have experienced a breach in 2008 that involved its computer server. Gair’s server appears to have been open to access through the Internet. Pinnacle became aware of the incident in mid-August when someone reported seeing patient information on the Internet. The information included Social Security numbers, medications, dates of birth, dates of interviews and dates of examinations.

On December 12, a laptop was found to be infected with malware.  PenFed current and former employees, beneficiaries, current and former members and joint owners may have had their names, Social Security numbers, addresses, credit and debit card numbers, and PenFed account numbers exposed. At least 514 New Hampshire residents were affected, but the total number of affected individuals nationwide was not reported.

UPDATE (1/18/11): The breach affected 674 New Hampshire residents and an unknown number of people nationwide.

UPDATE (1/6/11): The gas station closed shortly before customers started reporting fraudulent charges.  The former owner and two other people are being sought for questioning.  Customers had their debit and credit card information captured by a skimming device when they used their cards at a store ATM or inside the store.

UPDATE (1/10/11): The total number of victims is now at 380 and over $109,000 in fraudulent charges have been made.

A portable hard drive was stolen from the nursing department in early October.  It contained the Social Security numbers of several hundred alumni.

Patient and employee records were left in the Hospital after the facility was sold to Toledo Public Schools in 2003. The Hospital closed in 2002 and was sold in 2003. Records were left unsecured in the facility from 2003 until the discovery in November of 2010.

UPDATE (1/24/11): Around 2.2 million Honda customers had their information exposed. Around 2.7 million Acura customers had their email addresses exposed, but names and other information were not breached.

A laptop was stolen from the car of a registered nurse sometime between November 1 and 2. It contained a spreadsheet with patient names, dates of birth, medical record numbers, health provider names and diagnosis information. Patients were notified in late December because it took nearly two months to notify patients because the Clinic was determining what was on the laptop.