<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: mortgage]]></title>
    <link>http://securityratty.com/tag/mortgage</link>
    <description></description>
    <pubDate>Wed, 23 Apr 2008 06:13:09 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Canadian farmer personal information on stolen CCGA laptop]]></title>
      <link>http://securityratty.com/article/59ad7c04243f6352dc04e5847a1515dd</link>
      <guid>http://securityratty.com/article/59ad7c04243f6352dc04e5847a1515dd</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/4/08

Organization
Government of Canada

Contractor/Consultant/Branch
Canadian Canola Growers Association (CCGA

Victims
Farmers

Number Affected...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/ccga.jpg" align="right" height="82" width="168"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/4/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.gc.ca/home.html">Government of Canada</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.ccga.ca/OrganizationHome.htm">Canadian Canola Growers Association (CCGA)</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Farmers<br><br><span style="font-weight: bold;">Number Affected:</span><br>~32,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"social insurance numbers, bank account numbers and other data"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"OTTAWA, June 5 (UPI) -- Prairie farmers in Canada are upset the federal government waited two months to tell them a laptop computer containing their personal data was missing."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.winnipegfreepress.com/breakingnews/story/4182176p-4771903c.html">Winnipeg Free Press</a> <br><a href="http://www.cbc.ca/consumer/story/2008/06/05/canola-information.html">CBC News</a> <br><a href="http://www.upi.com/Top_News/2008/06/05/Personal_data_on_32000_farmers_missing/UPI-66311212671633/">United Press International</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Lindsay Wiebe, Winnipeg Free Press<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>About 32,000 Canadian farmers are on the alert after learning a laptop containing their financial information has been stolen.<br><br>The laptop was stolen when a programmer working for the Canadian Canola Growers Association took the machine off-site for routine maintenance.<br><span style="font-style: italic;">[Evan] No offense to programmers, but in my experience the ways they use information can be some of the most dangerous threats to information security.&nbsp; There is no reason for a programmer to EVER have access to confidential production information.&nbsp; Programmers should only be permitted to work with scrubbed information in a test and/or development environment.</span><br><br>CCGA general manager Rick White described the theft as a classic "smash and grab."<br><span style="font-style: italic;">[Evan] Also classic as in another organization that either does not know how or is unwilling to properly secure confidential information.</span><br><br>The laptop has the bank account numbers and social insurance numbers of farmers who applied for Agriculture Canada's advance payments program, which is administered by the CCGA on behalf of the federal government.<br><br>Although the theft happened March 30, Canadians weren't sent letters until last week informing them<br><br>The federal department has sent letters out to all farmers affected by the theft.<br><br>The letter said the laptop was stolen from an undisclosed, remote location in Manitoba.<br><br>"We treat this very seriously," White said. "This is an unfortunate incident, a very low-risk one."<br><span style="font-style: italic;">[Evan] Mr. White is probably not well versed in risk analysis.&nbsp; Or incident response for that matter.</span><br><br>the strict security measures being used on the laptop reduce the chances of information being misused, White said.<br><span style="font-style: italic;">[Evan] Like what?</span><br><br>"There was a very strong password protection on it, [and] there was a biometric fingerprint reader on it," he said. "That would prohibit anyone other than the user or the person with the password to access the data on the laptop."<br><span style="font-style: italic;">[Evan] These are "strict security measures"?&nbsp; My emphatic answer is NO!&nbsp; These "strict security measures" are easily bypassed.</span><br><br>but the data was not encrypted<br><span style="font-style: italic;">[Evan] The missing piece of the puzzle.&nbsp; Why go through all of the (self-proclaimed) "strict security measures" and not employ encryption.&nbsp; What you get with full-disk encryption is pre-boot authentication and this defeats the boot to CD attack.</span><br><br>Agriculture Canada spokesman Sean Malone said there were security features on the laptop, but a sophisticated hacker could likely bypass them.<br><span style="font-style: italic;">[Evan] No sophistication required.&nbsp; A novice could figure it out with Google, a CD, and 15 minutes.</span><br><br>So far, there have been no reports of identity theft among the farmers, the report said.<br><br>Pitblado LLP privacy lawyer Brian Bowman said the CCGA and agriculture department deserve credit for notifying people of the breach -- a move not required by Manitoba law.<br><span style="font-style: italic;">[Evan] Just because CCGA is not required by law, doesn't mean that they deserve any credit for notification.&nbsp; The information belongs to the victims not CCGA, and as owners of the information don't you think they should be informed of an incident that has the potential affect them personally?</span><br><br><span style="font-weight: bold;">Victim Reaction:</span><br>"If they're devilish enough to steal a computer, maybe they're devilish enough to do something with the information," <br><br>"What frustrates me is that they've treated this like it's no skin off their back,"<br><br>"They've known this since then and they're only getting the letters out now?"<br><br>"I don't want to find out a mortgage has been taken out on our farm."<br><br><span style="font-weight: bold;">Commentary:</span><br>It is bad enough for an organization to lose confidential information on a poorly protected laptop, but what makes this more troubling is the apparent fact that they still view the practice that led to the breach as a low risk.&nbsp; Clueless and sad. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Government of Canada:<br>December, 2007 - <a href="http://breachblog.com/2007/12/05/passport.aspx">Passport Canada web site suffers serious breach</a> <br>November, 2007 - <a href="http://breachblog.com/2007/11/26/servicecanada.aspx">Service Canada stolen laptop affects more than 1,600</a></font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/08/ccga.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Sun, 08 Jun 2008 15:32:52 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/laptop">laptop</category>
      <category domain="http://securityratty.com/tag/financial information">financial information</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/laptop affects">laptop affects</category>
      <category domain="http://securityratty.com/tag/computer">computer</category>
      <category domain="http://securityratty.com/tag/strict security measures">strict security measures</category>
      <category domain="http://securityratty.com/tag/ccga">ccga</category>
      <category domain="http://securityratty.com/tag/laptop computer">laptop computer</category>
      <source url="http://breachblog.com/2008/06/08/ccga.aspx">Canadian farmer personal information on stolen CCGA laptop</source>
    </item>
    <item>
      <title><![CDATA[Business Week blows the lid off of credit card companies ripping off consumers]]></title>
      <link>http://securityratty.com/article/7c3bef68538b7614a9a484b9b6b823fc</link>
      <guid>http://securityratty.com/article/7c3bef68538b7614a9a484b9b6b823fc</guid>
      <description><![CDATA[There is a great article in Business Week this week that talks about a scam that bank and credit card companies are pulling on consumers. It has resulted in the banks winning arbitration cases against...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p>There is a <a href="http://www.businessweek.com/magazine/content/08_24/b4088072611398.htm" target="_blank">great article in Business Week</a> this week that talks about a scam that bank and credit card companies are pulling on consumers.&nbsp; It has resulted in the banks winning arbitration cases against consumers to the tune of a 99.998% clip.&nbsp; That is right, 99.998%.&nbsp; It has turned arbitration, where an impartial judge makes determination into the biggest home field advantage this side of the NBA play offs. </p>

<p>It seems many of the credit card agreements that govern your use of credit cards call for arbitration to settle any disputes between you and the credit card company.&nbsp; Well the credit card company gets to pick the arbitration company. Many pick the National Arbitration Forum, which markets itself to the credit card companies as a form of collection agency.&nbsp; The whole system is basically stacked against the consumer, which results in the credit card companies getting their way.&nbsp; Business Week does a great job of digging in here and finding out all of the dirty secrets of this scam.&nbsp; I highly recommend you read the article for all of the details.</p>

<p>I don't think too many people disagree that over the last years there has been a big swing in the pendulum favoring business's over the consumer. Many of the laws and rules that were put in place to protect consumers over the years have either been thrown out or ignored.&nbsp; Our bankruptcy laws have been totally rewritten to the disadvantage of the consumer.&nbsp; Lazes-fare attitudes toward regulating business has seen oil companies raking in billions of dollars a quarter while we pay 4 dollars a gallon.&nbsp; Health insurance companies raising rates higher than inflation while hospitals have to close for not making enough money.&nbsp; A mortgage industry that without oversight has written loans that has our finance system to the brink of disaster. A return of <a href="http://www.marketwatch.com/news/story/consumers-battle-recession-inflation/story.aspx?guid={E796CAA9-755D-42B2-BCB5-8E85506AF58C}&amp;siteid=yahoomy">inflation and recession</a> at the same time.</p>

<p>Not too advertise my own political views, but do I think it is time for a change?&nbsp; Your damn right I do!&nbsp; I hope that the press shining the light on some of these injustices will make it easier for a new era in Washington to make right (no pun intended) some of the wrongs in our system.</p></div>
]]></content:encoded>
      <pubDate>Fri, 06 Jun 2008 17:45:31 +0000</pubDate>
      <category domain="http://securityratty.com/tag/credit card companies">credit card companies</category>
      <category domain="http://securityratty.com/tag/business week">business week</category>
      <category domain="http://securityratty.com/tag/week">week</category>
      <category domain="http://securityratty.com/tag/business">business</category>
      <category domain="http://securityratty.com/tag/consumers">consumers</category>
      <category domain="http://securityratty.com/tag/arbitration company">arbitration company</category>
      <category domain="http://securityratty.com/tag/arbitration">arbitration</category>
      <category domain="http://securityratty.com/tag/national arbitration forum">national arbitration forum</category>
      <category domain="http://securityratty.com/tag/credit card company">credit card company</category>
      <source url="http://www.stillsecureafteralltheseyears.com/ashimmy/2008/06/business-week-b.html">Business Week blows the lid off of credit card companies ripping off consumers</source>
    </item>
    <item>
      <title><![CDATA[Business Week blows the lid off of credit card companies ripping off consumers]]></title>
      <link>http://securityratty.com/article/50e16e6f0e10c7e9c3c42192a5c2af52</link>
      <guid>http://securityratty.com/article/50e16e6f0e10c7e9c3c42192a5c2af52</guid>
      <description><![CDATA[There is a great article in Business Week this week that talks about a scam that bank and credit card companies are pulling on consumers. It has resulted in the banks winning arbitration cases against...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p>There is a <a href="http://www.businessweek.com/magazine/content/08_24/b4088072611398.htm" target="_blank">great article in Business Week</a> this week that talks about a scam that bank and credit card companies are pulling on consumers.&nbsp; It has resulted in the banks winning arbitration cases against consumers to the tune of a 99.998% clip.&nbsp; That is right, 99.998%.&nbsp; It has turned arbitration, where an impartial judge makes determination into the biggest home field advantage this side of the NBA play offs. </p> <p>It seems many of the credit card agreements that govern your use of credit cards call for arbitration to settle any disputes between you and the credit card company.&nbsp; Well the credit card company gets to pick the arbitration company. Many pick the National Arbitration Forum, which markets itself to the credit card companies as a form of collection agency.&nbsp; The whole system is basically stacked against the consumer, which results in the credit card companies getting their way.&nbsp; Business Week does a great job of digging in here and finding out all of the dirty secrets of this scam.&nbsp; I highly recommend you read the article for all of the details.</p> <p>I don't think too many people disagree that over the last years there has been a big swing in the pendulum favoring business's over the consumer. Many of the laws and rules that were put in place to protect consumers over the years have either been thrown out or ignored.&nbsp; Our bankruptcy laws have been totally rewritten to the disadvantage of the consumer.&nbsp; Lazes-fare attitudes toward regulating business has seen oil companies raking in billions of dollars a quarter while we pay 4 dollars a gallon.&nbsp; Health insurance companies raising rates higher than inflation while hospitals have to close for not making enough money.&nbsp; A mortgage industry that without oversight has written loans that has our finance system to the brink of disaster. A return of inflation and recession at the same time.</p> <p>Not too advertise my own political views, but do I think it is time for a change?&nbsp; Your damn right I do!&nbsp; I hope that the press shining the light on some of these injustices will make it easier for a new era in Washington to make right (no pun intended) some of the wrongs in our system.</p></div>

<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=wCO6R1"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=wCO6R1" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=C6kZEI"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=C6kZEI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=ta6eZI"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=ta6eZI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=ORbiwI"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=ORbiwI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=wD3tnI"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=wD3tnI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=SSV7ai"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=SSV7ai" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=16q4ui"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=16q4ui" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/306500228" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 06 Jun 2008 16:45:40 +0000</pubDate>
      <category domain="http://securityratty.com/tag/credit card companies">credit card companies</category>
      <category domain="http://securityratty.com/tag/business week">business week</category>
      <category domain="http://securityratty.com/tag/week">week</category>
      <category domain="http://securityratty.com/tag/business">business</category>
      <category domain="http://securityratty.com/tag/consumers">consumers</category>
      <category domain="http://securityratty.com/tag/arbitration company">arbitration company</category>
      <category domain="http://securityratty.com/tag/arbitration">arbitration</category>
      <category domain="http://securityratty.com/tag/national arbitration forum">national arbitration forum</category>
      <category domain="http://securityratty.com/tag/credit card company">credit card company</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/306500228/business-week-b.html">Business Week blows the lid off of credit card companies ripping off consumers</source>
    </item>
    <item>
      <title><![CDATA[Did Hackers Cause the 2003 Northeast Blackout? Umm, No]]></title>
      <link>http://securityratty.com/article/3c2d2116b8ee150b05b02134afe71ea1</link>
      <guid>http://securityratty.com/article/3c2d2116b8ee150b05b02134afe71ea1</guid>
      <description><![CDATA[The latest cyberterrorism fairy tale circulating in Washington posits that Chinese government hackers were responsible for the worst power failure in U.S. history. Next week: How Chinese hackers...]]></description>
      <content:encoded><![CDATA[The latest cyberterrorism fairy tale circulating in Washington posits that Chinese government hackers were responsible for the worst power failure in U.S. history. Next week: How Chinese hackers caused Hurricane Katrina, the mortgage crisis and climate change.<br style="clear: both;"/>
      <a href="http://www.pheedo.com/click.phdo?s=6ff56388f8a737f5522160329cfa98c1"><img alt="" style="border: 0;" border="0" src="http://www.pheedo.com/img.phdo?s=6ff56388f8a737f5522160329cfa98c1"/></a>
  <img src="http://www.pheedo.com/feeds/tracker.php?i=6ff56388f8a737f5522160329cfa98c1" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=i0MVQH"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=i0MVQH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=ABd2sh"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=ABd2sh" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=taqDAh"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=taqDAh" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=EkJfIH"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=EkJfIH" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=ovysIH"><img src="http://feeds.wired.com/~f/wired/politics/security?i=ovysIH" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=NBlFzh"><img src="http://feeds.wired.com/~f/wired/politics/security?i=NBlFzh" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=4C7Onh"><img src="http://feeds.wired.com/~f/wired/politics/security?i=4C7Onh" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=ORaWEH"><img src="http://feeds.wired.com/~f/wired/politics/security?i=ORaWEH" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/301432012" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/301432014" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 30 May 2008 14:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/cyberterrorism fairy tale">cyberterrorism fairy tale</category>
      <category domain="http://securityratty.com/tag/chinese government hackers">chinese government hackers</category>
      <category domain="http://securityratty.com/tag/worst power failure">worst power failure</category>
      <category domain="http://securityratty.com/tag/hurricane katrina">hurricane katrina</category>
      <category domain="http://securityratty.com/tag/chinese hackers">chinese hackers</category>
      <category domain="http://securityratty.com/tag/washington posits">washington posits</category>
      <category domain="http://securityratty.com/tag/mortgage crisis">mortgage crisis</category>
      <category domain="http://securityratty.com/tag/history">history</category>
      <category domain="http://securityratty.com/tag/change">change</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/301432014/did-hackers-cau.html">Did Hackers Cause the 2003 Northeast Blackout? Umm, No</source>
    </item>
    <item>
      <title><![CDATA[Technical glitch blamed in The Princeton Tower Club breach]]></title>
      <link>http://securityratty.com/article/15351609f42234c5774ba9e03af7e8e7</link>
      <guid>http://securityratty.com/article/15351609f42234c5774ba9e03af7e8e7</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
5/8/08

Organization
The Princeton Tower Club

Contractor/Consultant/Branch
None

Victims
Former club members

Number Affected
103

Types of Data
names...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/tower.jpg" align="right" height="70" width="200"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>5/8/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.princeton.edu/%7Etower/Update2006/main/">The Princeton Tower Club</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Former club members<br><br><span style="font-weight: bold;">Number Affected:</span><br>103<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names and social security numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"Tower Club is taking steps to protect 103 of its alumni in the classes of 2006 and 2007 after a spreadsheet listing their names and social security numbers was e-mailed to current club members early Wednesday morning."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.dailyprincetonian.com/2008/05/09/21173/">The Daily Princetonian</a> <br><a href="http://www.upi.com/NewsTrack/Top_News/2008/05/10/princeton_club_accidentally_exposes_alumni/8122/">United Press International</a> <br><a href="http://www.app.com/apps/pbcs.dll/article?AID=/20080510/NEWS03/805100392/1007/NEWS03">Asbury Park Press</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Rachel Dunn and Josephine Wolff, The Daily Princetonian<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>Tower Club is taking steps to protect 103 of its alumni in the classes of 2006 and 2007 after a spreadsheet listing their names and social security numbers was e-mailed to current club members early Wednesday morning.<br><br>The document was attached to an apparently unrelated e-mail that informed current members about a club event.<br><br>The spreadsheet was attached unintentionally because of "a technical glitch," Tower graduate board chair Greg Berzolla ’87 said<br><span style="font-style: italic;">[Evan] Really?&nbsp; A technical glitch?&nbsp; These types of breaches are usually the result of human error.</span><br><br>"The [spreadsheet] file wasn’t even available on the hard drive [of the computer that sent the e-mail]," Berzolla said. "[The e-mail system] took an old e-mail and used it as a template [for Wednesday’s e-mail] as near as we can guess. It’s not a system very many people use or understand, that’s the problem."<br><br>"I cannot comment on [the glitch] because I don’t understand it," he said. "I didn’t figure it out, I think the club technical chair [did]. [Tower president] Stephanie [Burset ’09] tried to explain it to me, but I think she doesn’t really understand it either."<br><span style="font-style: italic;">[Evan] At least he is honest.</span><br><br>Burset said in an e-mail that Pine, the e-mail system Tower currently uses, is "fairly antiquated, but our tech chairs have assured me that nothing like this can ever happen again," and added that "we plan on switching to a new client whom is more secure and easier to use."<br><span style="font-style: italic;">[Evan] I am concerned by statements like "nothing like this can ever happen again".&nbsp; We still don't know why it happened in the first place.</span><br><br>The e-mail was sent by Tower officers from the tower@princeton.edu account to the roughly 200 current club members.<br><br>Tower officers sent another e-mail to the club yesterday asking members to delete the message from their mailboxes "out of respect for ’07."<br><br>Berzolla said he believes the risk of identity fraud is "extremely limited"<br><br>"It’s hard for any kind of fraud to occur that quickly," he said of the incident. "I feel confident that our club members are not going to use this information badly."<br><span style="font-style: italic;">[Evan] It only takes one person.&nbsp; It should also be mentioned that one or more of the destination email accounts could be a shared account and that these emails were sent in clear text (subject to the possibility of interception).</span><br><br>"[The breach] would have had to have been intentional [for there to be legal repercussions]," Berzolla said.<br><span style="font-style: italic;">[Evan] Do you have to demonstrate intent to argue negligence (The failure to use reasonable care)?&nbsp; I'm certainly not a lawyer, but I think that there are cases where victims have been awarded damages when there was not intent to harm on the part of the defendant.&nbsp; I don't really advocate lawsuits anyway, but I am just stating what seems obvious to me.</span><br><br>Tower will pay for an identity theft protection services for the affected individuals next year.<br><br>Berzolla hopes this measure will assuage any possible threat of legal action from former members against the club. "I don’t expect there to be any problems, but just in case," he said.<br><br>The social security numbers on the spreadsheet were collected as part of the process of signing in new members several years ago, Berzolla said. Tower no longer requires its members to submit their social security numbers, he added.<br><span style="font-style: italic;">[Evan] It is a good practice to not collect information that isn't required to conduct business.&nbsp; The Tower Club would be well advised to go through the information they currently possess and purge the information they no longer need.</span><br><br><span style="font-weight: bold;">Victim Reaction:</span><br>"I had no idea this happened, and frankly, I’m baffled and a little pissed off," Valerie McConnell ’07 said<br><br>"Now that I know that the social security numbers weren’t sent out on purpose, I’m not pissed off," McConnell said. "I think my identity is ok. I can’t imagine anyone in the club trying to steal my identity (not that there’s a lot to steal right now anyway)."<br><span style="font-style: italic;">[Evan] I think I would still be pissed off.&nbsp; Identity thieves are not all stupid.&nbsp; Many of them will hold on to the information for a year or more before using it or selling it.</span><br><br>"[The incident] is a mistake; it shouldn’t have happened," Beylin said in an e-mail. "However, with the number of times I’ve handed out my SSN this year while seeking financial services or apartment hunting, it’s really not my biggest source of concern for identity theft."<br><span style="font-style: italic;">[Evan] This is a good point.&nbsp; Have you ever thought of all the times you have given out your Social Security number?&nbsp; All of your employers, schools, insurance companies, banks, mortgage companies, credit card companies, etc. have your number.&nbsp; The same number used for identification and authentication.&nbsp; A recipe for disaster?</span><br><br><span style="font-weight: bold;">Commentary:</span><br>The Tower Club does not handle personal information any worse than most other organizations.&nbsp; It seems like they just didn't know any better.&nbsp; It sometimes makes me nervous. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/05/13/tower.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Tue, 13 May 2008 05:20:10 +0000</pubDate>
      <category domain="http://securityratty.com/tag/princeton tower club">princeton tower club</category>
      <category domain="http://securityratty.com/tag/tower club">tower club</category>
      <category domain="http://securityratty.com/tag/club">club</category>
      <category domain="http://securityratty.com/tag/club technical chair">club technical chair</category>
      <category domain="http://securityratty.com/tag/e-mail system tower">e-mail system tower</category>
      <category domain="http://securityratty.com/tag/e-mail system">e-mail system</category>
      <category domain="http://securityratty.com/tag/tower">tower</category>
      <category domain="http://securityratty.com/tag/system">system</category>
      <category domain="http://securityratty.com/tag/current club">current club</category>
      <source url="http://breachblog.com/2008/05/13/tower.aspx">Technical glitch blamed in The Princeton Tower Club breach</source>
    </item>
    <item>
      <title><![CDATA[Personal information from two Colorado mortgage companies found in dumpsters]]></title>
      <link>http://securityratty.com/article/7ae56d34b365648af4041ccd173db81f</link>
      <guid>http://securityratty.com/article/7ae56d34b365648af4041ccd173db81f</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
4/28/08

Organization
Cove Creek Mortgage
Front Range Mortgage, LLC

Contractor/Consultant/Branch
None

Victims
Customers

Number Affected
Unknown

Types...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/covecreek.jpg" align="right" height="82" width="167"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>4/28/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.covecreekmortgage.com/">Cove Creek Mortgage</a> <br><a href="http://www.frontrangemortgage.com/">Front Range Mortgage, LLC</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>Mortgage files, tax returns, pay stubs, Social Security numbers, and other personal information<br><br><span style="font-weight: bold;">Breach Description:</span><br>"ENGLEWOOD, Colo. -- The Arapahoe County District Attorney's Office is advising anyone who has used Cove Creek Mortgage to watch out for identity theft after hundreds of mortgage files were dumped in a public trash bin over the weekend."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.thedenverchannel.com/news/16038972/detail.html">Denver Channel 7 News</a> <br><a href="http://www.thedenverchannel.com/news/16064711/detail.html">Denver Channel 7 News (update)</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Denver Channel 7 News<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>ENGLEWOOD, Colo. -- The Arapahoe County District Attorney's Office is advising anyone who has used Cove Creek Mortgage to watch out for identity theft after hundreds of mortgage files were dumped in a public trash bin over the weekend.<br><span style="font-style: italic;">[Evan] Cove Creek Mortgage joins the ranks of other mortgage companies reported for similar breaches on The Breach Blog.&nbsp; The others are </span><a style="font-style: italic;" href="http://breachblog.com/2008/03/19/affordable.aspx">Affordable Realty</a><span style="font-style: italic;"> and </span><a style="font-style: italic;" href="http://breachblog.com/2008/02/29/unionmortgage.aspx">Union Mortgage Services of Cleveland, Inc.</a><span style="font-style: italic;">. </span><br><br>Cove Creek's owner had abandoned his Englewood office in January, and property managers had not been able to find him<br><i>[Evan] What kind of businessman just abandons an office full of confidential files and equipment?</i><br><br>On Saturday, the property manager had a crew clean out his office and throw all items from the office -- including complete mortgage files -- into two Dumpsters.<br><i>[Evan] Maybe the property manager should pay a little closer attention to the things they throw in the dumpster.&nbsp; Having said this, the property manager is not really at fault.</i><br><br>David Peters who works in the same complex found the files Monday morning.<br><br>"I was taking some other trash out to the garbage can and opened the lid and on there was a couple of laptops,"<br><br>"Directly underneath them were files with people's names on it and I was like, 'Well, this is not right.'"<br><br>"There were tax returns, pay stubs, everything in there," he said. "And as I looked at the different files I realized that it was mortgage files, which was kind of scary, because who do you disclose the most information to or all of your information? That is when you are getting a mortgage loan."<br><i>[Evan] According to the news report, Mr. Peters contacted authorities.&nbsp; This could have easily been much worse for victims.</i><br><br>The Dumpsters were not secured and located at 88 Inverness Drive East, Bldg. F.<br><br>Sheriff's investigators finally found the owner of Cove Creek and talked him into retrieving the files, many of which had private information, including Social Security numbers and credit history.<br><span style="font-style: italic;">[Evan] Mr. owner guy, will you please come get your stuff and the personal information that was entrusted to you?&nbsp; According to </span><a style="font-style: italic;" href="http://www.zoominfo.com/Search/PersonDetail.aspx?PersonID=41991084">zoominfo</a><span style="font-style: italic;"> a guy named Charlie Cartwright is/was the president of Cove Creek Mortgage.&nbsp; I have no idea if this is the same guy that is referred to in the news article.</span><br><br>The district aAttorney's office got a tip about numerous mortgage files and two laptop computers in a Dumpster behind offices formerly used by Cove Creek Mortgage and Front Range Mortgage.<br><i>[Evan] Now Front Range Mortgage joins the ranks.&nbsp; Front Range Mortgage offers <a href="http://www.frontrangemortgage.com/credit_consultants.html">credit repair services</a> too! Do you suppose they could have repaired the damage that could have been done?</i><br><br>"With a name, Social Security number and bank account number, they can clean you out before you even know," said Arapahoe County District Attorney Carol Chambers.<br><br>The files and computers contained sensitive information on many former customers of Front Range Mortgage, including names and addresses, Social Security numbers and bank, credit card and investment account information.<br><br>While there are civil laws against dumping such documentation, Chambers said it is not against the law.<br><i>[Evan] It's too bad that we have to write and enforce laws to protect us from idiots.</i><br><br>"I think it is a matter of legislation not catching up with the realities of identity theft," said Chambers. "And absolutely, we think recklessly disposing or negligently disposing of this kind of information should maybe carry a criminal penalty, just to get people's attention that you can't just leave this information or leave it out in a Dumpster."<br><br>"The district attorney recommends that any former customers of Front Range or Cove Creek should place a fraud alert on their credit reports and monitor any bank, credit card or investment accounts that might have been included on a mortgage application with that firm."<br><br>For further information, assistance or questions, call the District Attorney's Fraud Assistance Line at 720-874-8547.<br><br><b>Commentary:</b><br>What is with these mortgage companies?&nbsp; The 90's and early 2000's was a wild ride for mortgage brokers, real estate agents, and investors.&nbsp; The money attracted people from all walks of life and a lot of poor decisions were made.&nbsp; Now that the bubble has burst, we start to see the true colors of some of these "professionals".<br><br>I don't know much if anything about the owners of these companies, but I do know that securing personal information poorly is bad business. <br><br><b>Past Breaches:</b><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/05/07/covecreek.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 07 May 2008 18:20:50 +0000</pubDate>
      <category domain="http://securityratty.com/tag/mortgage files">mortgage files</category>
      <category domain="http://securityratty.com/tag/numerous mortgage files">numerous mortgage files</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/complete mortgage files">complete mortgage files</category>
      <category domain="http://securityratty.com/tag/personal information poorly">personal information poorly</category>
      <category domain="http://securityratty.com/tag/files">files</category>
      <category domain="http://securityratty.com/tag/cove creek mortgage">cove creek mortgage</category>
      <category domain="http://securityratty.com/tag/cove creek">cove creek</category>
      <source url="http://breachblog.com/2008/05/07/covecreek.aspx">Personal information from two Colorado mortgage companies found in dumpsters</source>
    </item>
    <item>
      <title><![CDATA[Cornerstone Fitness for Women information found in discarded file cabinet]]></title>
      <link>http://securityratty.com/article/0f0557fdc4dfeb37420b65decbea2603</link>
      <guid>http://securityratty.com/article/0f0557fdc4dfeb37420b65decbea2603</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
4/30/08

Organization
Cornerstone Fitness for Women

Contractor/Consultant/Branch
None

Victims
Customers

Number Affected
Unknown

Types of Data
Names,...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/cornerstone.jpg" align="right" height="82" width="197"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>4/30/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://cornerstonefitnessrgv.com/">Cornerstone Fitness for Women</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>Names, addresses, phone numbers and in many instances Social Security numbers copies of checks and credit card information<br><br><span style="font-weight: bold;">Breach Description:</span><br>"EDINBURG - A local company that operates several fitness centers across the region could be fined if investigators substantiate allegations it left clients' sensitive personal information in a trash bin."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.newschannel5.tv/2008/4/30/990568/Cornerstone-Identification-Problems">KRGV-TV Newschannel 5</a> <br><a href="http://www.themonitor.com/news/http_11597___article.html/www_idtheft2.html">The Monitor</a> <br><a href="http://www.brownsvilleherald.com/news/local_86350___article.html/fined_clients.html">The Brownsville Herald</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>KRGV-TV Newschannel 5<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>EDINBURG - A local company that operates several fitness centers across the region could be fined if investigators substantiate allegations it left clients' sensitive personal information in a trash bin.<br><br>This story came to our attention after NEWSCHANNEL 5's Lisa Cortez received a phone call from a complete stranger on her cell phone.<br><br>He had Lisa's contract from Cornerstone Fitness.<br><br>He knew not only her phone number, but also her address, employer, and a copy of a check used to pay her account.<br><br>He also had about 30 other contracts.<br><br>It has everything you would want to know about them. I think those people deserve to know about it, " said Zumwalt. (Sammy Zumwalt, the person that called Ms. Cortez)<br><br>All contracts list names, addresses and phone numbers. Some of them list social security numbers and have copies of checks and credit cards.<br><br>Zumwalt says his friend found a filing cabinet in a dumpster behind the former Cornerstone Fitness Center for Women in Edinburg.<br><br>The center shut down several months ago.<br><span style="font-style: italic;">[Evan] This isn't the first time that we have read about an organization vacating a location and leaving sensitive information behind (unsecured).&nbsp; Just in the past few months there was </span><a style="font-style: italic;" href="http://breachblog.com/2008/03/19/affordable.aspx">Affordable Realty</a><span style="font-style: italic;"> in March, and </span><a style="font-style: italic;" href="http://breachblog.com/2008/02/29/unionmortgage.aspx">Union Mortgage</a><span style="font-style: italic;"> and </span><a style="font-style: italic;" href="http://breachblog.com/2008/02/21/firstmagnus.aspx">First Magnus</a><span style="font-style: italic;"> in February.</span><br><br>The paperwork was in Zumwalt's room for several weeks.<br><br>Recently, he decided to go through the stack of papers and came across the sensitive information.<br><br>Zumwalt turned the contracts over to NEWSCHANNEL 5.<br><span style="font-style: italic;">[Evan] Why NEWSCHANNEL 5 and not the police or the Texas Attorney General?&nbsp; Do you think somebody wanted their 15 minutes of fame?</span><br><br>"At this point, we don't know what happened. This is not our usual practice. We are investigating it. We've been in the business for 10 years and this is the first time we hear of something like this. " (Joseph De la garza, one of the fitness club's owners)<br><br>NEWSCHANNEL 5 sorted through the contracts and contacted several members from the pile.<br><br>Cornerstone tells NEWSCHANNEL 5 they carefully guard all sensitive client information.<br><br>State Sen. Juan "Chuy" Hinojosa, D-McAllen, urged Texas Attorney General Greg Abbott to investigate, according to Jerry Strickland, a spokesman for the attorney general's office.<br><span style="font-style: italic;">[Evan] I guess this is one good thing about reporting it to the media instead of the authorities.&nbsp; Mr. Hinojosa sees it on TV and pushes for an investigation.</span><br><br>"A lot of businesses are being very careless in the way they handle personal information," Hinojosa said. "Businesses (are required) to shred all information they no longer need."<br><span style="font-style: italic;">[Evan] Oh yes, very true.</span><br><br><span style="font-weight: bold;">Victim Reaction:</span><br>"I mean, I don't even know how to explain how I feel, because I am so in shock," said one woman after we read her social security number.<br><br>Denise Grant told NEWSCHANNEL 5, "You never realize how important this information is until you have to try to prove that you are who you say you are." (a woman who claims to have been an victim of identity theft before)<br><br><span style="font-weight: bold;">Commentary:</span><br>Well, we all know (or should know) that this type of breach is nothing new, but I am keyed in on what Mr. Hinojosa stated, "A lot of businesses are being very careless in the way they handle personal information".&nbsp; <br><br>What will urge businesses to be more careful and secure personal information better?&nbsp; More laws?&nbsp; More costly fines?&nbsp; More laws mean more compliance.&nbsp; More compliance means more cost to companies.&nbsp; More cost to companies means more expensive goods and services.&nbsp; Seems that the same argument holds true for fines.<br><br>Maybe we should stop using a single identifier for all things personal (i.e. Social Security numbers).&nbsp; Do you think that the credit bureaus and the rest of the financial industry would go for such a radical idea?&nbsp; Do you know how the credit bureaus make money (I won't go into this now)?&nbsp; This would be a tough battle to fight.<br><br>An easy to implement solution does not exist.&nbsp; We have walked so far down this road that I think we may have gotten a little lost.&nbsp; <br><br>I have ranted long enough.&nbsp; On to the next breach, right? <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/05/05/cornerstone.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 05 May 2008 10:01:48 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/secure personal information">secure personal information</category>
      <category domain="http://securityratty.com/tag/sensitive information">sensitive information</category>
      <category domain="http://securityratty.com/tag/handle personal information">handle personal information</category>
      <category domain="http://securityratty.com/tag/personal">personal</category>
      <category domain="http://securityratty.com/tag/credit card information">credit card information</category>
      <category domain="http://securityratty.com/tag/cornerstone fitness">cornerstone fitness</category>
      <category domain="http://securityratty.com/tag/cornerstone tells newschannel">cornerstone tells newschannel</category>
      <category domain="http://securityratty.com/tag/newschannel">newschannel</category>
      <source url="http://breachblog.com/2008/05/05/cornerstone.aspx">Cornerstone Fitness for Women information found in discarded file cabinet</source>
    </item>
    <item>
      <title><![CDATA[Former LendingTree employees sold access to customer information]]></title>
      <link>http://securityratty.com/article/96c5f0c82b86cf3610eb2db23ae99bad</link>
      <guid>http://securityratty.com/article/96c5f0c82b86cf3610eb2db23ae99bad</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
4/21/08

Organization
IAC/InterActiveCorp (IAC

Contractor/Consultant/Branch
LendingTree, LLC

Victims
Customers

Number Affected
Unknown

Types of Data...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/lendingtree.jpg" align="right" height="59" width="200"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>4/21/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.iac.com/">IAC/InterActiveCorp (IAC)</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.lendingtree.com/">LendingTree, LLC</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>"loan request data such as name, address, email address, telephone number, Social Security number, income and employment information"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"Recently, LendingTree learned that several former employees may have taken Company passwords and given them to a handful of lenders. These lenders then used the passwords to access LendingTree customer information files, normally available only to LendingTree-approved lenders, to market loans to LendingTree's customers."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.lendingtree.com/info/faq.asp#quest01">LendingTree FAQs</a> <br><a href="http://redtape.msnbc.com/2008/04/was-your-lendin.html">MSNBC Red Tape Chronicles</a> <br><a href="http://www.networkworld.com/news/2008/042208-lendingtree-breach.html">NetworkWorld</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>LendingTree<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>LendingTree has told its customers that former employees helped unauthorized mortgage lenders hack into its systems and steal customer information from 2006 to 2008.<br><span style="font-style: italic;">[Evan] From Rob Douglas, editor of InsideIDTheft.info "Given that data was accessed from 2006 to early 2008, it can be inferred that passwords used by former employees remained operational for months or even years after their employment was terminated, generally considered poor security practice"</span><br><br>Recently, LendingTree learned that several former employees may have taken Company passwords and given them to a handful of lenders. <br><span style="font-style: italic;">[Evan] Monitoring insider activity for fraud is a difficult challenge for information security personnel, especially when the credentials (username/password) used are valid.</span><br><br>These lenders then used the passwords to access LendingTree customer information files, normally available only to LendingTree-approved lenders, to market loans to LendingTree's customers.<br><br>The files contained loan request data such as name, address, email address, telephone number, Social Security number, income and employment.<br><span style="font-style: italic;">[Evan] Sheesh!&nbsp; This is everything that a bad guy (or gal) would need to do some serious damage.</span><br><br>A LendingTree spokeswoman said the company was not granting interviews to discuss the data theft. She would not say how many customers were affected nor how much data was stolen, but instead supplied a copy of the customer letter sent by the firm.<br><br>Our internal security uncovered this situation. We began an internal investigation and reported it to the authorities. We continue to assist the authorities and are telling our customers as soon as it was possible to do so.<br><br>Credit card information (such as account number or account balance) was not involved.<br><span style="font-style: italic;">[Evan] No need, with information such as name, address, email address, telephone number, Social Security number, income and employment, a fraudster could get his/her own credit card.</span><br><br>We promptly enhanced the security of our system so that this situation couldn't happen again. We also brought lawsuits against the lenders and other persons involved.<br><span style="font-style: italic;">[Evan] What?&nbsp; How do you promptly fix human behavior?&nbsp; If there were such a simple fix for the problem that led to this incident then why wasn't it implemented prior to the incident?&nbsp; I don't buy it.</span><br><br>we have no reason to believe any identity theft or fraudulent financial activity resulted from this situation<br><br>You still might want to get a free credit report and file a fraud alert with the credit bureaus. When you get your credit report, look for any accounts you didn't open and/or inquiries from creditors that you didn't initiate. If you see anything you don't understand, contact the credit bureau.<br><span style="font-style: italic;">[Evan] What if an affected individual has already used their free annual credit report? </span><br><br>LendingTree believes that the information accessed was limited to mortgage customer loan requests only, which were then used by the mortgage lenders to solicit those customers for mortgage loans.<br><br>We brought a lawsuit against Newport Lending Group, Irvine, California; Home Loan Consultants, Inc., Newport Beach, California; and Sage Credit Company, Irvine, California, in connection with this incident.<br><span style="font-style: italic;">[Evan] I wonder what the lawsuits seek.</span><br><br>LendingTree sent emails or letters to the mortgage customers that it believes, based on its investigation to date, might be at risk of having their information accessed and used by these mortgage companies to solicit mortgage loans.<br><br>You should also be vigilant for 12 to 24 months in reviewing bank and credit card statements and any future credit reports.<br><span style="font-style: italic;">[Evan] As long as Social Security numbers are still used for authentication, people should remain vigilant, whether it be 12, 24, or 300 months.</span><br><br>You can call LendingTree at 866-505-8874 to speak with one of our customer service representatives who are available from 9am to 9pm ET seven days a week.<br><span style="font-style: italic;">[Evan] Well thank you for permission Mr. LendingTree</span><br><br><span style="font-weight: bold;">Commentary:</span><br>I don't necessarily fault LendingTree too much for the incident occurrence.&nbsp; Preventing internal privileged access abuse is a real challenge.&nbsp; There are some controls that can reduce risk, but we don't know which of these are in use at LendingTree.&nbsp; I think it was just a matter of time.&nbsp; Actually, I would be surprised if this was the first time with past occurrences remaining internal and private.&nbsp; <br><br>What I do fault LendingTree for is a really poor public response.&nbsp; There are no apologies in the FAQs for the inconvenience.&nbsp; There is no offer of any real assistance.&nbsp; There is no readily available information on the company's web site (the FAQs are very hard to find without any direct link from the home page).&nbsp; The information (once found) given by LendingTree is much less than what would make me comfortable.&nbsp; Overall, their response gives off this general feeling of arrogance. <br><br>Personally, I am a LendingTree customer as I have applied for a previous car loan through them.&nbsp; Am I to take LendingTree at their word and believe that this breach only affected mortgage applications?&nbsp; What controls were in place to prevent employees from granting access to my data?&nbsp; I need more detailed information about the investigation and what LendingTree did to "promptly" enhance security before I conduct business with them again. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/04/23/lendingtree.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 23 Apr 2008 09:08:37 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/lendingtree">lendingtree</category>
      <category domain="http://securityratty.com/tag/necessarily fault lendingtree">necessarily fault lendingtree</category>
      <category domain="http://securityratty.com/tag/fault lendingtree">fault lendingtree</category>
      <category domain="http://securityratty.com/tag/employment information">employment information</category>
      <category domain="http://securityratty.com/tag/credit card information">credit card information</category>
      <category domain="http://securityratty.com/tag/lendingtree faqs">lendingtree faqs</category>
      <category domain="http://securityratty.com/tag/information security personnel">information security personnel</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <source url="http://breachblog.com/2008/04/23/lendingtree.aspx">Former LendingTree employees sold access to customer information</source>
    </item>
    <item>
      <title><![CDATA[An old/new kind of cybercrime/cybercriminal]]></title>
      <link>http://securityratty.com/article/abd5ef59363a1cc39e068bb96b87c611</link>
      <guid>http://securityratty.com/article/abd5ef59363a1cc39e068bb96b87c611</guid>
      <description><![CDATA[I was reading Ellen Messmer's report today about the security incident over at Lending Tree. Yeah, I know another information breach by insiders case, BFD. But I think there is something different...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p>I was reading <a href="http://www.networkworld.com/news/2008/042208-lendingtree-breach.html?nlhtsec=ts_042308&amp;nladname=042308securityal" target="_blank">Ellen Messmer's report</a> today about the security incident over at Lending Tree. Yeah, I know another information breach by insiders case, BFD.&nbsp; But I think there is something different about this one.&nbsp; From what I am reading this is more a case of corporate espionage than the usual hackers for fraud and financial gain type of deal.&nbsp; For a long time now we have been hearing from people like <a href="http://www.networkworld.com/news/2008/031408-insider-pose-threat-for.html" target="_blank">Bruce Schneier in this article</a> talk about the front in security moving from dealing with script kiddies working for kicks to organized cybercriminal gangs that are in it for financial gain. Mostly the gain is about identity theft and gaining access to funds fraudulently. </p>

<p>In the Lending Tree case though there was not evidently a motive to use the ill begotten information for identity theft or fraud.&nbsp; Rather they represented Glengary, Glen Ross leads.&nbsp; That is the names, contacts and qualifications of people looking for mortgages.&nbsp; A mortgage company would consider these leads more valuable than gold, more valuable even that gasoline!&nbsp; So to my mind this is more a case of corporate espionage where a company that is competitive to Lending Tree infiltrated their networks through people, rather than technology to gain access to their corporate crown jewels.&nbsp; </p>

<p>This sort of stealing your competitors information has been going on for decades, well before computers and cybercrime were around.&nbsp; However, this is a great example of some things not going out of style.&nbsp; Obtaining your competitors information is a great motive, computers are just the container where the information is kept.&nbsp; Sort of like cracking a safe.&nbsp; It is always easier getting into a safe if you are given the combination, than if you have to crack it yourself.&nbsp; </p>

<p>Yet another front in the cybercrime war that security folks need to be on guard for!</p></div>
]]></content:encoded>
      <pubDate>Wed, 23 Apr 2008 07:13:09 +0000</pubDate>
      <category domain="http://securityratty.com/tag/financial gain type">financial gain type</category>
      <category domain="http://securityratty.com/tag/financial gain">financial gain</category>
      <category domain="http://securityratty.com/tag/gain">gain</category>
      <category domain="http://securityratty.com/tag/information breach">information breach</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/gain access">gain access</category>
      <category domain="http://securityratty.com/tag/access">access</category>
      <category domain="http://securityratty.com/tag/competitors information">competitors information</category>
      <category domain="http://securityratty.com/tag/cybercrime">cybercrime</category>
      <source url="http://www.stillsecureafteralltheseyears.com/ashimmy/2008/04/an-oldnew-kind.html">An old/new kind of cybercrime/cybercriminal</source>
    </item>
    <item>
      <title><![CDATA[An old/new kind of cybercrime/cybercriminal]]></title>
      <link>http://securityratty.com/article/6dd15a44de078c80d2bddebe2791cfd4</link>
      <guid>http://securityratty.com/article/6dd15a44de078c80d2bddebe2791cfd4</guid>
      <description><![CDATA[I was reading Ellen Messmer's report today about the security incident over at Lending Tree. Yeah, I know another information breach by insiders case, BFD. But I think there is something different...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p>I was reading <a href="http://www.networkworld.com/news/2008/042208-lendingtree-breach.html?nlhtsec=ts_042308&amp;nladname=042308securityal" target="_blank">Ellen Messmer's report</a> today about the security incident over at Lending Tree. Yeah, I know another information breach by insiders case, BFD.&nbsp; But I think there is something different about this one.&nbsp; From what I am reading this is more a case of corporate espionage than the usual hackers for fraud and financial gain type of deal.&nbsp; For a long time now we have been hearing from people like <a href="http://www.networkworld.com/news/2008/031408-insider-pose-threat-for.html" target="_blank">Bruce Schneier in this article</a> talk about the front in security moving from dealing with script kiddies working for kicks to organized cybercriminal gangs that are in it for financial gain. Mostly the gain is about identity theft and gaining access to funds fraudulently. </p>

<p>In the Lending Tree case though there was not evidently a motive to use the ill begotten information for identity theft or fraud.&nbsp; Rather they represented Glengary, Glen Ross leads.&nbsp; That is the names, contacts and qualifications of people looking for mortgages.&nbsp; A mortgage company would consider these leads more valuable than gold, more valuable even that gasoline!&nbsp; So to my mind this is more a case of corporate espionage where a company that is competitive to Lending Tree infiltrated their networks through people, rather than technology to gain access to their corporate crown jewels.&nbsp; </p>

<p>This sort of stealing your competitors information has been going on for decades, well before computers and cybercrime were around.&nbsp; However, this is a great example of some things not going out of style.&nbsp; Obtaining your competitors information is a great motive, computers are just the container where the information is kept.&nbsp; Sort of like cracking a safe.&nbsp; It is always easier getting into a safe if you are given the combination, than if you have to crack it yourself.&nbsp; </p>

<p>Yet another front in the cybercrime war that security folks need to be on guard for!</p></div>

<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=ln2ZiF"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=ln2ZiF" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=kwL6FpG"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=kwL6FpG" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=rTI4XrG"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=rTI4XrG" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=X4f7lMG"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=X4f7lMG" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=SKx1GMG"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=SKx1GMG" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=jTcSSwg"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=jTcSSwg" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=p5CPmfg"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=p5CPmfg" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/276222491" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 23 Apr 2008 06:13:09 +0000</pubDate>
      <category domain="http://securityratty.com/tag/financial gain type">financial gain type</category>
      <category domain="http://securityratty.com/tag/financial gain">financial gain</category>
      <category domain="http://securityratty.com/tag/gain">gain</category>
      <category domain="http://securityratty.com/tag/information breach">information breach</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/gain access">gain access</category>
      <category domain="http://securityratty.com/tag/access">access</category>
      <category domain="http://securityratty.com/tag/competitors information">competitors information</category>
      <category domain="http://securityratty.com/tag/cybercrime">cybercrime</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/276222491/an-oldnew-kind.html">An old/new kind of cybercrime/cybercriminal</source>
    </item>
  </channel>
</rss>
