Personal information of 2.3 million people illegally removed from database
In the third largest data breach this year, an employee steals records of 2.3 million people from company’s data base and sells them to marketers
Jacksonville, Florida-based Fidelity National Information Services has admitted that personal information on 2.3 million people has been illegally removed from its database. The breach occurred at Certegy Check Services, a company that handles check and credit card monitoring for merchants and casinos. Fidelity stressed that no computer systems were compromised in the data theft. The information was collected and transported by a database administrator who was placed in charge of data access privileges.
Vnunet reports that the employee also ran a data brokering business, and the stolen information, which included addresses, phone numbers, dates of birth, and in some cases credit card and bank account numbers, was then sold off to marketers. Fidelity said the breach was not discovered until a retailer contacted Certegy to complain that several customers had been receiving phone calls and mail from solicitors.
Unable to find any record of an electronic breach in its network, Certegy called the U.S. Secret Service which traced the data back to a brokerage company run by the employee. Certegy maintains that no cases of fraud or identity theft have been reported in connection to the breach. Of the 2.3 million records compromised, 99,000 contained credit card information, while the remainder contained bank account information.
Beth Givens, director of consumer watchdog group Privacy Rights Clearinghouse, described the breach as “horrendous”: “Any company that holds sensitive personal information should have an electronic audit trail and flagging system so that key people can be notified when sensitive data is accessed.” Privacy Rights Clearinghouse said that the Certegy incident is the third largest data breach this year. In April, a disk was lost containing information on 2.9 million people went mission from the Georgia Department of Community Health. In January, criminals stole more than 45 million credit and debit card numbers from retail chain TJ Maxx in the largest personal data breach ever recorded.
