http://securityratty.com/tag/magnus Thu, 21 Feb 2008 10:56:43 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss http://securityratty.com/article/0f0557fdc4dfeb37420b65decbea2603 http://securityratty.com/article/0f0557fdc4dfeb37420b65decbea2603 Security Breach

Date Reported:
4/30/08

Organization:
Cornerstone Fitness for Women

Contractor/Consultant/Branch:
None

Victims:
Customers

Number Affected:
Unknown

Types of Data:
Names, addresses, phone numbers and in many instances Social Security numbers copies of checks and credit card information

Breach Description:
"EDINBURG - A local company that operates several fitness centers across the region could be fined if investigators substantiate allegations it left clients' sensitive personal information in a trash bin."

Reference URL:
KRGV-TV Newschannel 5
The Monitor
The Brownsville Herald

Report Credit:
KRGV-TV Newschannel 5

Response:
From the online sources cited above:

EDINBURG - A local company that operates several fitness centers across the region could be fined if investigators substantiate allegations it left clients' sensitive personal information in a trash bin.

This story came to our attention after NEWSCHANNEL 5's Lisa Cortez received a phone call from a complete stranger on her cell phone.

He had Lisa's contract from Cornerstone Fitness.

He knew not only her phone number, but also her address, employer, and a copy of a check used to pay her account.

He also had about 30 other contracts.

It has everything you would want to know about them. I think those people deserve to know about it, " said Zumwalt. (Sammy Zumwalt, the person that called Ms. Cortez)

All contracts list names, addresses and phone numbers. Some of them list social security numbers and have copies of checks and credit cards.

Zumwalt says his friend found a filing cabinet in a dumpster behind the former Cornerstone Fitness Center for Women in Edinburg.

The center shut down several months ago.
[Evan] This isn't the first time that we have read about an organization vacating a location and leaving sensitive information behind (unsecured).  Just in the past few months there was Affordable Realty in March, and Union Mortgage and First Magnus in February.

The paperwork was in Zumwalt's room for several weeks.

Recently, he decided to go through the stack of papers and came across the sensitive information.

Zumwalt turned the contracts over to NEWSCHANNEL 5.
[Evan] Why NEWSCHANNEL 5 and not the police or the Texas Attorney General?  Do you think somebody wanted their 15 minutes of fame?

"At this point, we don't know what happened. This is not our usual practice. We are investigating it. We've been in the business for 10 years and this is the first time we hear of something like this. " (Joseph De la garza, one of the fitness club's owners)

NEWSCHANNEL 5 sorted through the contracts and contacted several members from the pile.

Cornerstone tells NEWSCHANNEL 5 they carefully guard all sensitive client information.

State Sen. Juan "Chuy" Hinojosa, D-McAllen, urged Texas Attorney General Greg Abbott to investigate, according to Jerry Strickland, a spokesman for the attorney general's office.
[Evan] I guess this is one good thing about reporting it to the media instead of the authorities.  Mr. Hinojosa sees it on TV and pushes for an investigation.

"A lot of businesses are being very careless in the way they handle personal information," Hinojosa said. "Businesses (are required) to shred all information they no longer need."
[Evan] Oh yes, very true.

Victim Reaction:
"I mean, I don't even know how to explain how I feel, because I am so in shock," said one woman after we read her social security number.

Denise Grant told NEWSCHANNEL 5, "You never realize how important this information is until you have to try to prove that you are who you say you are." (a woman who claims to have been an victim of identity theft before)

Commentary:
Well, we all know (or should know) that this type of breach is nothing new, but I am keyed in on what Mr. Hinojosa stated, "A lot of businesses are being very careless in the way they handle personal information". 

What will urge businesses to be more careful and secure personal information better?  More laws?  More costly fines?  More laws mean more compliance.  More compliance means more cost to companies.  More cost to companies means more expensive goods and services.  Seems that the same argument holds true for fines.

Maybe we should stop using a single identifier for all things personal (i.e. Social Security numbers).  Do you think that the credit bureaus and the rest of the financial industry would go for such a radical idea?  Do you know how the credit bureaus make money (I won't go into this now)?  This would be a tough battle to fight.

An easy to implement solution does not exist.  We have walked so far down this road that I think we may have gotten a little lost. 

I have ranted long enough.  On to the next breach, right?

Past Breaches:
Unknown

]]> Mon, 05 May 2008 10:01:48 +0000 information secure personal information sensitive information handle personal information personal credit card information cornerstone fitness cornerstone tells newschannel newschannel Cornerstone Fitness for Women information found in discarded file cabinet http://securityratty.com/article/85b93bd12c93d79cf76aababb75a2f48 http://securityratty.com/article/85b93bd12c93d79cf76aababb75a2f48 Security Breach

Date Reported:
3/19/08

Organization:
Affordable Realty

Contractor/Consultant/Branch:
None

Victims:
Customers

Number Affected:
"hundreds"

Types of Data:
"Social Security numbers and financial records"

Breach Description:
"Social Security numbers and financial records of customers of a Flint-based realty mortgage company have been found in a dumpster. "

Reference URL:
WJRT ABC Channel 12 News

Report Credit:
Dawn Jones, ABC12 News Team

Response:
From the online source cited above:

The personal information of hundreds of local residents is now out in public view.

Social Security numbers and financial records of customers of a Flint-based realty mortgage company have been found in a dumpster.
 
Affordable Realty occupied office space inside the Ben Agree building on Dort Highway for years.
 
The company was evicted and all of its sensitive customer information ended up outside in a dumpster or on the ground nearby.
[Evan] Maybe the company figured that they had nothing to lose and just vacated the property.  There is liability however.  The leader(s) of the company is/are morally, ethically, and probably legally responsible for proper document destruction.  There really is no excuse.

Included in the papers are bankruptcy statements, financial records, Social Security numbers and addresses of clients who once did business with Affordable Realty.

Witnesses say the business had recently been evicted and they report seeing Genesee County Sheriff's Deputies clearing the office space a few days ago.
[Evan] So am I safe to assume that the Genesee County Sheriff's Deputies actually had a hand in the poor handling of sensitive documents?  Perhaps they could have been more careful and taken the time to identify sensitive documents before throwing them in the dumpster.

Since that time, at least one person claims to have seen people rummaging through the dumpster, picking up papers, going through them very carefully and walking away with some.

We talked to Genesee County Sheriff Robert Pickell about how this type of personal information should be handled.
 
"What the process server should have done is get the stuff, call the landlord and say 'I'm packing this up, I'm putting it into my truck, I'm taking it to my warehouse. You're gonna have to pay for the storage,'" Pickell told ABC12's Dawn Jones.
[Evan] And what the Sheriff's Deputies should have done is taken more care before throwing the documents in the dumpster.

The sheriff talks more about identity theft and how to protect your identity coming up later today on ABC12 News.

Commentary:
This isn't the first time we have read about personal information being discarded/disclosed in a public dumpster after a company has gone out of business.  Last month included Union Mortgage Services of Cleveland, Inc. and First Magnus Financial Corporation.  Throwing large amounts of documentation containing personal information in the trash is completely in-excusable and lazy.  The good thing is that the companies are now out of business; the bad thing is that they may have taken some good people along with them.

I am concerned and uneasy about the fact that the Genesee County Sheriff's Deputies did not notice or take the time to investigate what the documents contained.

Past Breaches:
Unknown

]]> Wed, 19 Mar 2008 11:57:40 +0000 company abc12 news team news dumpster documents sheriff sheriff talks company isare abc12 news Another mortgage company out of business leads to more documents in the dumpster http://securityratty.com/article/e521113877509ae97abc821cd675e5d7 http://securityratty.com/article/e521113877509ae97abc821cd675e5d7 Security Breach

Date Reported:
2/22/08, updated on 2/28/08

Organization:
Union Mortgage Services of Cleveland, Inc.

Contractor/Consultant/Branch:
None

Victims:
Loan applicants

Number Affected:
Unknown*

*"hundreds of people" including "Thousands of pages of sensitive documents"

Types of Data:
Information that is typically found in loan applications, including bank statements, credit reports, and tax returns.

Breach Description:
Thousands of pages of sensitive loan application information were discovered in a dumpster behind a pizza shop in Cleveland, Ohio.  The documents were allegedly discarded by employees of Union Mortgage Services of Cleveland, Inc., which has closed down after failing to pay taxes or failure to file tax returns.

Reference URL:
WKYC-TV News

Report Credit:
WKYC-TV News, by way of Attrition.org

Response:
From the online source cited above:

Thousands of pages of sensitive documents were thrown out in a dumpster located behind a pizza shop at East 105th and Superior in Cleveland.

Confidential files were found on hundreds of people who applied for loans with a company called Union Mortgage, whose last known addresses were in Beachwood and Parma.
[Evan] Union Mortgage Services addresses are/were; 23611 Chagrin Blvd Suite 275 Beachwood, OH 44122 and 1440 Snow Road Suite 118 Parma, OH 44134

Investigator Tom Meyer learned the company closed its doors recently after either failing to pay taxes or file its tax returns
[Evan] Sounds shady for a mortgage company that people trust much of their financial lives with.

Channel 3 News retrieved as many documents as possible and returned them to their rightful owners.

Ken Knabe, a lawyer from Lakewood, was shocked that we had his bank accounts, credit reports, tax returns and other personal information including his social security number. "That's appalling. This is private information in a dumpster,"

Channel 3 News returned files of information on Kim and Edwin Soeder of Mentor, including their retirement accounts. "It makes you wonder how bad your credit rating becomes if people get this in their hands," said Mrs. Soeder.

Ohio Attorney General, Marc Dann, has sued another mortgage company, Randall Mortgage Services, Inc., for allegedly abandoning customers' loan and financial information. Dann says he would take action against Union Mortgage if customers came forward and filed complaints with his office.



[Evan] Attorney General Marc Dann's site has some good information for consumers.  To file a complaint, visit http://www.ag.state.oh.us/citizen/consumer/complaints.asp

Dann said businesses that collect personal information are responsible for protecting it just like they would protect their own information.

Commentary:
This is similar to the First Magnus breach reported earlier this month.  Similarities include two financially troubled (or bankrupt) loan companies that figured their obligation to protect confidential personal information ceased when they closed the doors.  The obligation to protect information entrusted to you only ceases when you transfer custodianship (i.e. return it to the owner, destruction, etc.)

I assume that we will only continue to see more of these types of breaches as more loan companies continue to suffer from today's credit crunch.  When I researched Union Mortgage Services for this posting, I had a general sense of uneasiness.  The lack of discovered background information and other legitimate references about the company might have made me question whether or not I would have done business with them in the first place.  Hindsight is 20/20 they say.

Past Breaches:
Unknown

]]> Fri, 29 Feb 2008 11:14:23 +0000 information collect personal information personal information union mortgage loan loan companies continue loan companies union mortgage services background information Union Mortgage loan applicant information found in dumpster http://securityratty.com/article/ccc96b82673139919d57577f8ada9e89 http://securityratty.com/article/ccc96b82673139919d57577f8ada9e89 Security Breach

Date Reported:
2/15/08

Organization:
First Magnus Financial Corporation

Contractor/Consultant/Branch:
None

Victims:
Customers

Number Affected:
Unknown

Types of Data:
Loan and financial documents containing names, addresses, phone numbers, Social Security numbers, credit card numbers, financial account information, etc.

Breach Description:
Stacked boxes containing thousands of sensitive loan and financial documents were discovered in an dumpster outside a Ft. Lauderdale, Florida branch of the now bankrupt First Magnus Financial Corporation.  The documents contain sensitive personal information belonging to customers.

Reference URL:
CBS Channel 4 News online story

Report Credit:
Carey Codd, CBS Channel 4

Response:
From the online source cited above:

Outside a University of Phoenix Building in Ft. Lauderdale, files and paperwork belonging to the defunct First Magnus Financial at 550 West Cypress Creek Road were just lying inside stacked boxes inside an industrial garbage container, available for anyone to peek at.

The paperwork contains some of the most sensitive information a consumer could posses: Social Security numbers, credit card information, addresses, properties, etc.

Shortly after CBS4 News cameras arrived on Friday, employees of the building removed the boxes and took them indoors, all while police officers from Ft. Lauderdale arrived and roped off access to the dumpster and started an investigation.
[Evan] The Ft. Lauderdale Police Department treats the location of this breach as a crime scene, which it obviously is.  Common sense, right?  Not so much in some police departments.  I have read credible reports of police refusing to even come to the scene and taking reports over the telephone.  Kudos to the Ft. Lauderdale Police Department.

"We were told that we just could get rid of this stuff no matter how, that this was going to end up in the landfill, it's going to be drenched down here inside the container, and no one's going to have access to it," said Mike Shank.
[Evan] This is lazy, reckless, and overall bad business (assuming that this statement is accurate).

The building management is supposedly waiting for officials with First Magnus to come and properly dispose of the sensitive documents.
[Evan] I wouldn't hold my breath.  First Magnus is bankrupt and has not paid employees after the company folded on August 16, 2007.  Who from First Magnus is left to come and get the documents?

Commentary:
Bankruptcy stinks.  It stinks for creditors, customers and employees.  This bankruptcy stinks a little more for customers because of poor common sense and judgment.  Thankfully, someone reported the poorly discarded documents in the dumpster and reported it before (it appears) they fell into the hands of the nefarious.  I wonder where the documents are now and who has access to them, supposing they still exist. 

Not only did First Magnus have a business responsibility for the protection of senstive information (which ceases with the business), but they also have a moral responsibility (which does not cease).

Past Breaches:
Unknown

]]> Thu, 21 Feb 2008 10:56:43 +0000 magnus magnus financial magnus financial corporation police police officers documents sensitive documents police departments financial documents First Magnus Financial customer data found in dumpster