Data Leak at Stem Cell Bank Makes My Blood Run Cold

The Big Payback

Laptop_Marlon_Bunday_CCFlickr I’ve read a lot of breach notification letters like this one, and the following line has to be one of my favorite passages from any of them:

“Although we do not believe this situation will involve identity theft out of concern and caution we have developed a plan to provide you with additional protection and peace of mind.”

CBR then offers a one–year membership in the Experian Triple Alert program.

Whew. Now that’s a relief. You are relieved, aren’t you? CBR is banking on the fact that because a computer and other property were stolen from the car, the tapes were not the target of the theft.

Get everything you need to master your credit today.

Get started for free

Why am I not hearing a collective sigh of relief?

Is there no one willing to jump on the “relief” train?

[Resource: Identity Theft Emergency]

“What happens after one year?” says Ondrej Krehel, Information Security Officer at Identity Theft 911, a Credit.com sister company. “Once our Social Security number is somewhere out there, it could be hard to prevent ID theft in the future.”

Identities are currency. They are evergreen. Like fine wine they get better with age. The most sophisticated identity thieves understand that oftentimes banking identities leads to greater return than simply running about the countryside opening accounts within days of a breach. Please do not underestimate the fact that once someone with ill intentions gains access to your identity they have an option on your life. The question then becomes “when” and not “if” he or she chooses to exercise that option.

Sorry!

“We very much regret that this situation occurred,” the letter says.

And I am sure they do. I’m just not so sure that when a CBR client suffers a personal identity theft incident that CBR’s regret will be of great comfort to them.

Look, I believe that CBR does important work and have no doubt that they really are horrified by what happened here. I’ve been tough on them in this column, but in truth they are far from alone. They are simply another Flavor of the Month. Recently, Health Net suffered a data breach involving potentially 1.9 million current and past customers, health care providers and employees. Health Net’s woes represented its second breach incident in 2 years. In 2009, they reported that a hard drive containing financial and medical information on 1.5 million customers had gone astray. This time several servers at a Health Net data center operated by IBM went walkabout. Forgive my disbelief, but how does one lose several servers? Needless to say, several federal and state regulatory authorities—not to mention a fleet load of their clients—were less than amused.

Over the past several years, an enormous number of data breach incidents involving medical providers and facilities have occurred. It is most curious to me that those who are genuinely dedicated to saving lives are so woefully inadequate when it comes to protecting those very lives from exposure to potential economic, emotional and criminal dislocation.

We are in the process of digitizing millions of medical records so that more and more people will have access to our sensitive personal and medical information in a national effort to make it easier and more efficient to save lives. That is a double-edged sword. Access without appropriate security protocols can easily lead to inappropriate exposure and significant negative ramifications.

For too long business and industry has been more covetous of their trade secrets and intellectual property than the protection of their most precious asset—the personal identifying information of patients, clients, customers and employees.

A few weeks ago, we recognized National Consumer Protection Week. Frankly, every week of the year should be National Consumer Protection Week. Hopefully, every hour of every day we begin to reflect upon ways to better protect the health, safety and welfare of the American public.

I have no doubt that this message has renewed meaning for the folks at CBR. Their clients, the government and the ultimate regulators of the American economic system—class action law suit attorneys—will be watching how this saga unfolds over the next twelve months with great interest.

Image: Marlon Bunday, via Flickr.com