The database compromise club has a new member. Mazel Tov, Cord Blood Registry. You are the latest organization to fail in your responsibility to your clients by neglecting to provide even minimal security for their personal data. Your membership card is in the mail.
Who is CBR?
Before diving into the data leak, let’s learn a bit more about Cord Blood Registry. CBR is perhaps the world’s largest stem cell bank storing more than 350,000 cord blood collections for individuals and their families.
As my Credit.com colleague Chris Maag wrote: “The Cord Blood Registry saves stem cells from umbilical cords, which is useful in treatment for sickle cell anemia, and in transplant surgeries to minimize the risk of new organs getting rejected by the body. Researchers are studying other potential uses, including regenerating cells to repair damaged tissue.”
They claim to be the biggest and “baddest” at what they do.
“Our 80,000 square foot laboratory is the largest cord blood processing facility in the world with some of the most advanced technology in the industry.”
As CBR says on their website:
You can rely on our experience and expertise for your family.
But based on what they lost, how they lost it, when they lost it, the timing and way they explained it, it’s obvious that they have some serious work to do if they want to regain their clients’ trust.
OOPS!
300,000 CBR clients received this belated Valentine’s Day card from David Zitlow, Executive Vice President for External Affairs. It opens with the following:
“I am writing to let you know that an incident occurred that may lead to personal information about you being exposed.”
The personal information referenced is of a demographic and financial nature. Translation: names, Social Security numbers, driver’s license numbers, credit card numbers and credit card expiration dates.
Apparently, a backpack containing three unencrypted storage tapes, a Dell laptop, zip drive and external hard drive was stolen from a CBR employee’s car, shortly before midnight on December 13, 2010 outside of 365 Main Street—a private data center in San Francisco.
According to a story on Health Data Management, CBR did not immediately post information about the breach on their site and it took them several weeks to get the word out to their client base.
As reported by Paul NcNamara in Buzzblog, Kathy Engle, CBR’s director of corporate communications told him that clinical data was not breached—in other words, a hacker wasn’t able to get through their security protocols. That’s the good news … kind of. For the 300,000 whose information was compromised, the manner of leak is not nearly as important as the fact that it happened in the first place. And as far as I’m concerned, the fact that the data was neither encrypted nor locked in a secure environment (a car trunk is not a secure environment) is just plain nuts. When it comes to data security, that’s the bare minimum.
“Keeping your personal information secure is of the utmost importance to us,” the letter reads.
Sure it is. That’s why the names, addresses, Social Security Numbers, credit card numbers and credit card expiration dates of some 300,000 clients was neatly packed in a backpack in the back of a “locked” car in San Francisco. I guess someone exercised some degree of care—I mean the car might have been left unlocked.
The letter goes on to say:
“CBR also brought in computer security experts to evaluate potential risks. Our experts have advised us there is no indication that any of your personal information has been accessed or misused.”
It should really read, “… no indication that your personal information has been accessed or misused yet.” The information is out there. It’s been in the press. Rest assured, somewhere out there identity thieves are making inquiries.
But the best is yet to come.
The Big Payback
I’ve read a lot of breach notification letters like this one, and the following line has to be one of my favorite passages from any of them:
“Although we do not believe this situation will involve identity theft out of concern and caution we have developed a plan to provide you with additional protection and peace of mind.”
CBR then offers a one-year membership in the Experian Triple Alert program.
Whew. Now that’s a relief. You are relieved, aren’t you? CBR is banking on the fact that because a computer and other property were stolen from the car, the tapes were not the target of the theft.
Why am I not hearing a collective sigh of relief?
Is there no one willing to jump on the “relief” train?
“What happens after one year?” says Ondrej Krehel, Information Security Officer at Identity Theft 911, a Credit.com sister company. “Once our Social Security number is somewhere out there, it could be hard to prevent ID theft in the future.”
Identities are currency. They are evergreen. Like fine wine they get better with age. The most sophisticated identity thieves understand that oftentimes banking identities leads to greater return than simply running about the countryside opening accounts within days of a breach. Please do not underestimate the fact that once someone with ill intentions gains access to your identity they have an option on your life. The question then becomes “when” and not “if” he or she chooses to exercise that option.
Sorry!
“We very much regret that this situation occurred,” the letter says.
And I am sure they do. I’m just not so sure that when a CBR client suffers a personal identity theft incident that CBR’s regret will be of great comfort to them.
Look, I believe that CBR does important work and have no doubt that they really are horrified by what happened here. I’ve been tough on them in this column, but in truth they are far from alone. They are simply another Flavor of the Month. Recently, Health Net suffered a data breach involving potentially 1.9 million current and past customers, health care providers and employees. Health Net’s woes represented its second breach incident in 2 years. In 2009, they reported that a hard drive containing financial and medical information on 1.5 million customers had gone astray. This time several servers at a Health Net data center operated by IBM went walkabout. Forgive my disbelief, but how does one lose several servers? Needless to say, several federal and state regulatory authorities—not to mention a fleet load of their clients—were less than amused.
Over the past several years, an enormous number of data breach incidents involving medical providers and facilities have occurred. It is most curious to me that those who are genuinely dedicated to saving lives are so woefully inadequate when it comes to protecting those very lives from exposure to potential economic, emotional and criminal dislocation.
We are in the process of digitizing millions of medical records so that more and more people will have access to our sensitive personal and medical information in a national effort to make it easier and more efficient to save lives. That is a double-edged sword. Access without appropriate security protocols can easily lead to inappropriate exposure and significant negative ramifications.
For too long business and industry has been more covetous of their trade secrets and intellectual property than the protection of their most precious asset—the personal identifying information of patients, clients, customers and employees.
A few weeks ago, we recognized National Consumer Protection Week. Frankly, every week of the year should be National Consumer Protection Week. Hopefully, every hour of every day we begin to reflect upon ways to better protect the health, safety and welfare of the American public.
I have no doubt that this message has renewed meaning for the folks at CBR. Their clients, the government and the ultimate regulators of the American economic system—class action law suit attorneys—will be watching how this saga unfolds over the next twelve months with great interest.
Originally posted at Credit.com.
