<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: wendy]]></title>
    <link>http://securityratty.com/tag/wendy</link>
    <description></description>
    <pubDate>Thu, 03 Jan 2008 11:08:27 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Pocono Mountain School District "irregularities"]]></title>
      <link>http://securityratty.com/article/428a87c41a9a2ff786e39b2738b49910</link>
      <guid>http://securityratty.com/article/428a87c41a9a2ff786e39b2738b49910</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
5/30/08

Organization
Pocono Mountain School District

Contractor/Consultant/Branch
None

Victims
Students and parents

Number Affected
Unknown

SCHOOL...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/poconosd.jpg" align="right" height="103" width="72"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>5/30/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.pmsd.org/Home/tabid/36/Default.aspx">Pocono Mountain School District</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Students and parents<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown*<br><br><font size="1">*"SCHOOL DISTRICT ENROLLMENT (2007-2008) 11,500 students K-12 (Current as of Oct. 17, 2007)"</font><br><br><span style="font-weight: bold;">Types of Data:</span><br>"Student ID, network password, SSN if provided, ethnicity, gender, birthdate, grade, grade year, building no., building name, homeroom no., homeroom teacher, attendance code (if absent today), dietary allergies (for food services), bus assignment, free/reduced lunch status, home phone, primary home mailing address, secondary mailing address, parent names, parent phone numbers, emergency contact names, and emergency contact phone numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"An apparent cyber break-in of Pocono Mountain School District's computer system has put at potential risk personal information about students and parents, the district announced Friday.<br><br>District Superintendent Dwight Pfennig sent home letters on Friday afternoon telling parents about the apparent breach, which the district found out about the previous evening, according to Wendy Frable, director of public information."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.pmsd.org/Home/tabid/36/mid/1293/newsid1293/64/Letter-to-Parents-on-Computer-Security/Default.aspx">Pocono Mountain School District "Letter to Parents"</a> <br><a href="http://www.poconorecord.com/apps/pbcs.dll/article?AID=/20080601/NEWS/806010334">Pocono Record</a> <br><a href="http://www.mcall.com/news/local/all-b4_3pocono.6436000may31,0,1422227.story">The Morning Call</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Pocono Mountain School District<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>A hacker apparently broke into the computers at Pocono Mountain School District and may have tapped into confidential information concerning students and their parents, the district's superintendent said Friday.<br><span style="font-style: italic;">[Evan] This statement is provided by Joe McDonald of The Morning Call.&nbsp; It is unclear if a "hacker" breached the system or if there was another cause for the "irregularities" reported at the school.</span><br><br>District Superintendent Dwight Pfennig sent home letters on Friday afternoon telling parents about the apparent breach, which the district found out about the previous evening, according to Wendy Frable, director of public information.<br><span style="font-style: italic;">[Evan] This is a quick notification.&nbsp; I think it is possible to be too quick in notifying victims, almost like The Boy Who Cried Wolf.&nbsp; It seems as though the school has not gathered the facts required to make a proper notification.&nbsp; Judge for yourself.</span><br><br>Frable said the district's technical staff had noted some irregularities during a routine security check Thursday night. "They detected some activity that seemed a little unusual," she said.<br><br>The technical staff is checking to see to what extent any personal information — and to whom it may belong — had been compromised.<br><br>The district referred the matter to Pennsylvania State Police at Swiftwater for further investigation, Frable said.<br><br>The information that may have been compromised includes the following: Student ID, network password, SSN if provided, ethnicity, gender, birthdate, grade, grade year, building no., building name, homeroom no., homeroom teacher, attendance code (if absent today), dietary allergies (for food services), bus assignment, free/reduced lunch status, home phone, primary home mailing address, secondary mailing address, parent names, parent phone numbers, emergency contact names, and emergency contact phone numbers.<br><br>"We don't know if anything was accessed," she said, adding that the district will contact anyone whose data had been found to be compromised. Frable also said that very few records include children's Social Security numbers.<br><span style="font-style: italic;">[Evan] A breach involving children's personal information is especially bothersome. </span><br><br>We have conducted an internal investigation and suggest you take the following preventative measures now to help prevent and detect any misuse of your or your child’s information.<br><br>"As a first step to protect yourself from the possibility of identity theft, we recommend you closely monitor any accounts that may contain any or some of this information," Pfennig wrote in his letter to parents.<br><br>If you see any unauthorized activity, promptly contact your service provider and or office of the Executive Director of Technology at (570) 873-7121 Ext. 10151.<br><br>"We're just trying to do what's right by everyone," Frable said. "There's no reason to panic anyone, but people should just be cautious."<br><span style="font-style: italic;">[Evan] Understandable, but some people will panic anyway.&nbsp; This is why it’s a good idea to gather facts before notification.</span><br><br>Parents got the letters when their children returned at the end of the school day, and at least one parent felt the school was being rather nonchalant. <br><br>''It sounds to me like they're trying to downplay it,'' said Ralph Ortega, who lives in Jackson Township. ''It's incredibly vague.''<br><span style="font-style: italic;">[Evan] I agree.&nbsp; I question whether this is because there aren't enough facts available yet, or whether the school is not being square with the victims.</span><br><br><span style="font-weight: bold;">Commentary:</span><br>This breach leaves us with more questions than answers.&nbsp; People will speculate where there is a lack of clarity.&nbsp; I hope students and parents get the answers to the questions that they should demand answers too. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/02/poconosd.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 02 Jun 2008 08:36:33 +0000</pubDate>
      <category domain="http://securityratty.com/tag/district">district</category>
      <category domain="http://securityratty.com/tag/school">school</category>
      <category domain="http://securityratty.com/tag/contact">contact</category>
      <category domain="http://securityratty.com/tag/promptly contact">promptly contact</category>
      <category domain="http://securityratty.com/tag/school district enrollment">school district enrollment</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/emergency contact names">emergency contact names</category>
      <category domain="http://securityratty.com/tag/breach description">breach description</category>
      <source url="http://breachblog.com/2008/06/02/poconosd.aspx">Pocono Mountain School District "irregularities"</source>
    </item>
    <item>
      <title><![CDATA[Laptop stolen from HealthSpring employee affects members]]></title>
      <link>http://securityratty.com/article/11d9eec15284fe060ec4a2fa1eb790f7</link>
      <guid>http://securityratty.com/article/11d9eec15284fe060ec4a2fa1eb790f7</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
5/22/08

Organization
HealthSpring

Contractor/Consultant/Branch
None

Victims
Members

Number Affected
9,000

Types of Data
names, dates of birth and...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/healthspring.jpg" align="right" height="49" width="200"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>5/22/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="https://www.healthspring.com/">HealthSpring</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Members<br><br><span style="font-weight: bold;">Number Affected:</span><br>~9,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, dates of birth and social security numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>HealthSpring Inc. is notifying members whose personal information was stored on a stolen laptop computer used by an employee of the company.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.tennessean.com/apps/pbcs.dll/article?AID=/20080522/BUSINESS01/805220343/1003/NEWS01">The Tennessean</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Wendy Lee, The Tennessean by way of Attrition.org <a href="http://attrition.org/dataloss/">Data Loss Archive and Database</a> <br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>Nashville-based managed care company HealthSpring Inc. said Wednesday a laptop computer containing personal information of about 450 state residents was stolen in March.<br><br>The laptop, believed to contain names, dates of birth and social security numbers of about 9,000 individuals, was stolen from a HealthSpring employee's locked car on March 30 in Houston<br><span style="font-style: italic;">[Evan] Why was it important for this information to be stored on a laptop computer (without encryption)?&nbsp; This is a question for which data owners (affected members) should be able to demand an answer to.&nbsp; This was not company information; this was information that was entrusted to the company by the members.</span><br><br>HealthSpring said the theft was reported to police on April 1 and it does not believe any of the information on the laptop has been misused.<br><span style="font-style: italic;">[Evan] <span style="font-weight: bold;">IF </span>it were to be misused, I doubt we would see signs of it (yet).</span><br><br>The company sent a letter dated May 7 to the individuals affected by the theft, encouraging them to use a credit monitoring and identity theft restoration service.<br><br>HealthSpring will pay for the service.<br><span style="font-style: italic;">[Evan] I did not find details that outline how long the company will pay for the service, but the "standard" is one year.&nbsp; Identity thieves know this, and what do you think they are likely to do?&nbsp; Wait a year (or however long the paid for service runs), then use the information.&nbsp; I don't want to spread fear, but the threat is real.&nbsp; Chances are probably less than 50/50 that this will happen, but why should a victim have to worry due to a data custodian's (HealthSpring in this instance) poor protection?</span><br><br>"We take it very seriously and feel badly about it," said Jerry Coil, executive vice president and chief operating officer.<br><br>He added that he thinks it's "highly unlikely" any data was compromised.<br><span style="font-style: italic;">[Evan] Based on?</span><br><br>The stolen laptop was password protected but not encrypted<br><span style="font-style: italic;">[Evan] The "highly unlikely" assessment certainly couldn't be based on this fact.</span><br><br>Coil said the company has been in the process of encrypting all of its laptops and desktop computers.<br><span style="font-style: italic;">[Evan] An excellent step in the right direction.</span><br><br><span style="font-weight: bold;">Commentary:</span><br>Breaches resulting from a lost or stolen laptop computer containing confidential information without encryption are NOT breaking news.&nbsp; These are reported regularly.&nbsp; So what would be the excuse?&nbsp; It's hard to claim that you didn't know any better.<br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/05/22/healthspring.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Thu, 22 May 2008 07:25:42 +0000</pubDate>
      <category domain="http://securityratty.com/tag/laptop">laptop</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/company information">company information</category>
      <category domain="http://securityratty.com/tag/laptop computer">laptop computer</category>
      <category domain="http://securityratty.com/tag/company">company</category>
      <category domain="http://securityratty.com/tag/evan based">evan based</category>
      <category domain="http://securityratty.com/tag/evan">evan</category>
      <source url="http://breachblog.com/2008/05/22/healthspring.aspx">Laptop stolen from HealthSpring employee affects members</source>
    </item>
    <item>
      <title><![CDATA[Wayport Tops 10,000 McDonald's Locations]]></title>
      <link>http://securityratty.com/article/f8771881a38c1fc7d001b68fa32359dc</link>
      <guid>http://securityratty.com/article/f8771881a38c1fc7d001b68fa32359dc</guid>
      <description><![CDATA[Ten thousand is an arbitrary place to put a stick in the sand, but significant nonetheless: The milestone of 10,000 McDonald's wired up--a few hundred have back access only, due to being stores within...]]></description>
      <content:encoded><![CDATA[<p><strong><a href="http://www.wayport.com/NewsReleases.aspx?id=1832">Ten thousand is an arbitrary place to put a stick in the sand, but significant nonetheless:</a></strong> The milestone of 10,000 McDonald's wired up--a few hundred have back access only, due to being stores within WalMart centers--is a vindication of Wayport's long-term strategy, dating back to 2004. Wayport switched at that point from a slightly more public-faced, public-access company to one that understood that back-office operations could be just as valuable, if less sexy, than front-facing consumer networks. Dan Lowden, Wayport's long-time marketing and business development chief, said yesterday, "In a lot of these venues, the back office comes first. The Wi-Fi public access for some is a big priority, but for others it's a nice to have, great thing to have, but the priority is the back office."</p>

<p>Although several other quick-service restaurants like McDonald's lack any comprehensive Wi-Fi plan--Burger King, Wendy's, and Subway to name three of the largest--Wayport is locked out of working with direct competitors. This opens the potential for another firm to handle a several-thousand-location network. Wayport has worked with both McDonald's corporate-owned stores (about 2/3rds of stores in the U.S.), as well as reaching out to franchisees, who Lowden noted pay a predetermined flat rate for the service via McDonald's. "It's made them incredibly efficient to be able to offer this to their franchisees at one price, instead of variable pricing," he noted. Wayport acts as the layer between various telecom providers, applications and services, and the stores.</p>

<p>Wayport provides several kinds of back-office services, although credit-card processing was the first thing htey rolled out. They've extended to remote video feeds for security, Redbox DVD rental systems that are found in some McDonald's, and kiosks used for job applications. Lowden said Wayport offers things as straightforward but critical as a dial-up fail-safe when a broadband connection drops. </p>

<p>Wayport also manages AT&T's hotspot network, which puts them in the unwiring seat for the 7,000-odd Starbucks stores that will converted from T-Mobile to AT&T service during 2008. Wayport was once the clear leader in the hotspot builder market, with T-Mobile in the second position. Now, Wayport will be operating through a direct contract or management agreement over 18,000 hotspots in the U.S.; T-Mobile will likely be the second biggest with a couple thousand locations (Borders and FedEx/Kinko's tops among them). The No. 3 player is hard to figure. Panera? </p>

<p>I've been predicting for some time that media on the edge--music, videos, movies, and games stored on servers on the local Wi-Fi network--will be the next big development in venue-oriented Wi-Fi, with Starbucks likely far in the lead. Lowden wouldn't comment on any specific plans in the works, of course, but said generally, "Storing and caching all that content on the edge...hasn't been leveraged in the past, but it will be in the future to create a very unique experience." At Barnes & Noble, Wayport caches some multimedia data that's available to customers in the stores.</p>

<p>The advantage for in-store media storage is that you can leverage the speed of the local network, and add additional access points to distribute network load. The choke point is no longer the Internet connection, but local network speed. I expect--though Wayport, AT&T, and Starbucks haven't said it--that Starbucks infrastructure will be all 802.11n for this reason, likely with both 2.4 GHz and 5 GHz support for the best throughput in the higher-frequency band for media transactions. (In fact, I wouldn't be surprised if you could only buy movies via 5 GHz.)</p>

<p>Lowden also noted that the proliferation of mobile devices with Wi-Fi built in have led to them reaching out to venues that wouldn't have made sense for them to work with previously, and for unlikely candidates to reach out to them, too. Wayport is now working with a number of healthcare facilities that, while they have their own network infrastructure, wanted to outsource public access Wi-Fi (whether they choose to charge or underwrite it), and certain applications that they're not as experienced with running themselves.</p>

<p><strong>A little history:</strong> In 2001 and again in 2004, the heat seemed to be on the public side of Wi-Fi: lots of money to be made, ostensibly, lots of partnerships and venues to be built, and an overcrowded supply of infrastructure builders. The year before, Wayport looked to be an also-ran in the hotspot provider business. </p>

<p>Despite being one of the earliest firms to put Ethernet and then Wi-Fi into hotels, and build out hotspots in airports; and despite their survival of the first hotspot meltdown in 2001 during the dotcom crash and brief venture capital shortage; and despite their early entrance into allowing wholesale pricing for hotspot aggregators; the firm seemed about to be eclipsed by apparently deep-pocketed Cometa (with AT&T, IBM, and Intel in various capital and support roles), Toshiba's mom-and-pop focused turnkey system, and T-Mobile, which had the Starbucks contract. What a difference a year makes.</p>

<p>Cometa, Toshiba, and Wayport contended for the contract to build out back-office and public-access service at McDonald's in the U.S., and Wayport won. Within a few weeks, Toshiba passed its few hundred locations to Cometa, which shut its doors in May 2004. Wayport, meanwhile, had <a href="http://wifinetnews.com/archives/003377.html">cooked up a strategy</a> for McDonald's that it announced later that month. </p>

<p>Their approach involved a fixed-rate charged for unlimited access by retail network partners for all the locations in their pool. This meant that partners had a fixed cost, instead of a per-session cost, and Wayport could obtain specific revenue even before usage by a partner ramped up. Wayport hasn't discussed the details of this arrangement in depth since, but has partnered with Sony with its Mylo, Nintendo with its DS game player, and ZipIt with its wireless messaging appliance. </p>

<p>The McDonald's deal also apparently gave Wayport a way to extend its work with SBC-later-AT&T; Wayport had earlier in 2004 <a href="http://wifinetnews.com/archives/003151.html">became the managed-services contractor</a> for SBC to build out The UPS Store/Mailboxes Etc. nationwide. (UPS <a href="http://wifinetnews.com/archives/007770.html">dropped AT&T as its partner</a> in mid-2007, although that didn't appear to have anything to do with Wayport's role.)</p>

<p>AT&T through Wayport developed its large resold/managed footprint that incorporated resale of Wayport's McDonald's locations with the UPS Store and a few hundred other managed locations, including a handful of airports. The Cingular acquisition of AT&T Wireless put more airports in SBC's hands, too. (SBC was once the 60 percent majority owner of Cingular; when SBC and BellSouth, the other owner, merged that put the newly rebranded AT&T in charge of Cingular which it relabeled as AT&T. Confusing, huh?)</p>]]></content:encoded>
      <pubDate>Tue, 29 Apr 2008 05:25:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wayport">wayport</category>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/comprehensive wi-fi plan">comprehensive wi-fi plan</category>
      <category domain="http://securityratty.com/tag/local wi-fi network">local wi-fi network</category>
      <category domain="http://securityratty.com/tag/att service">att service</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/wayport offers">wayport offers</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/wayport caches">wayport caches</category>
      <source url="http://wifinetnews.com/archives/008294.html">Wayport Tops 10,000 McDonald's Locations</source>
    </item>
    <item>
      <title><![CDATA[Hundreds of WiseBuys customers are victims of credit card fraud]]></title>
      <link>http://securityratty.com/article/6a6e2e458675a57e767b333a17041140</link>
      <guid>http://securityratty.com/article/6a6e2e458675a57e767b333a17041140</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
4/24/08

Organization
WiseBuys Stores, Inc

Contractor/Consultant/Branch
WiseBuys of Canton

WiseBuys Plaza, 5533 US Highway 11, Canton, NY 13617,...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/wisebuys.jpg" align="right" height="52" width="198"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>4/24/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.wisebuysstores.com/index.php">WiseBuys Stores, Inc.</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.wisebuysstores.com/locations.php">WiseBuys of Canton</a> <br><br><font size="1">WiseBuys Plaza, 5533 US Highway 11, Canton, NY 13617, 315.379.0456</font><br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>"hundreds"<br><br><span style="font-weight: bold;">Types of Data:</span><br>"credit and debit card numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"Hundreds of credit and debit card numbers were stolen in December at the Canton Wisebuys store, according to Canton Village Police."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.watertowndailytimes.com/article/20080425/NEWS05/133127784">Watertown Daily News</a> <br><a href="http://www.newswatch50.com/news/local/story.aspx?content_id=af161116-25f2-4a78-ab2e-c730e28cc4bb">WWTI Channel 50 News</a> <br><a href="http://news10now.com/content/all_news/114840/credit-card-numbers-stolen-from-canton-wisebuys/Default.aspx">TWEAN News Channel of Syracuse</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>WWTI Channel 50 News<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>CANTON — Police are investigating hundreds of reports of thefts of credit and debit card numbers belonging to customers who shopped at WiseBuys department store in December.<br><br>"We have had hundreds of victims and thousands of thefts. We have had amounts as high as $3,000 and as low as $10," said Sgt. Lori A. McDougal of the village police department. "I would say at this point they total upwards of $100,000."<br><br>Victims are all believed to have shopped at the Canton WiseBuys store between Dec. 5 and 20<br><br>Since then, stolen credit card numbers have been used to create fake cards in New York City.<br><br>The fraudulent cards were used to pay for taxi rides, to buy food at a Wendy's Restaurant and to make purchases at New York City drug stores and other locations.<br><br>"We had the New York City police call us about one of our cards that was picked up in a sting," said Scott A. Wilson, president and chief executive officer of SeaComm Federal Credit Union, which has a branch in Canton.<br><br>Complaints about the thefts began to come in early in March as victims received their monthly bank and credit card statements<br><br>"At this point we are not sure how the numbers were obtained. It may be an employee or it may be somebody who hacked into their system," Ms. McDougal said.<br><br>Hannaford Bros., which operates supermarkets in the Northeast including stores in Watertown and Massena, reported the theft of up to 4.2 million credit and debit card numbers from 300 of its stores in March.<br><span style="font-style: italic;">[Evan] I think Watertown, NY is ~60 miles from Canton, and Massena is ~30 miles away.</span><br><br>It is unknown if there is any similarity between the Hannaford thefts and the WiseBuys thefts.<br><span style="font-style: italic;">[Evan] I certainly don't know enough to speculate (but I will later <img src="http://breachblog.com/emoticons/wink.png" border="0" />).</span><br><br>"We have people working on it," said Norman V. Garrelts, chief executive officer of Hacketts, which took over operation of WiseBuys after a November merger.<br><br>"We had no inkling it was going on. The police notified us," he said. "How anybody could have hacked into the system, I am not a big enough geek to know. It happened over a day or two."<br><span style="font-style: italic;">[Evan] I think there are many organizations that have "no inkling".&nbsp; CEOs like Mr. Garrelts don't need to be "a big enough geek" to know how the companies they run are managing information security.&nbsp; CEOs are the ones that are ultimately responsible.&nbsp; Information security should be governed in such a way that it has visibility with the CEO.&nbsp; Information security is an organizational issue, <span style="font-weight: bold;">NOT </span>an IT (or geek) issue.</span><br><br>"We have rechecked all of our safeguards and everything seems to be in order," Mr. Garrelts said. "It should not have been able to happen."<br><span style="font-style: italic;">[Evan] This incident is proof of the contrary.&nbsp; I agree that it should not have been able to happen, but it <span style="font-weight: bold;">DID </span>happen.&nbsp; The question is what is the "it"?</span><br><br>The Canton store was the only one in the WiseBuys and Hacketts chain that was affected by the number thefts. The stores use the credit card processing system used by nearly every True Value hardware store in the nation, Mr. Garrelts said.<br><br>WiseBuys changed its computer system in December and investigators are attempting to determine whether that was when the numbers were stolen<br><br>Village police have begun interviewing about 30 WiseBuys employees but so far have not identified any as suspects.<br><br>District Attorney Nicole M. Duvé, who learned of the thefts Thursday, said she takes the thefts seriously.<br><br>"This is starting to eat up a lot of law enforcement time and a lot of our time. I intend to take a very dim view of anybody caught doing it," she said.<br><span style="font-style: italic;">[Evan] I wonder what the ultimate cost of incidents like this really is.&nbsp; Law enforcement time, employee time, bank and credit issuer time, victim time, actual fraud dollar amounts, prosecutorial time, etc. etc.&nbsp; It all ends up, and somebody has to pay for it all, right?</span><br><br>Debit and credit card issuers believed to have been affected by the thefts to date include Community Bank N.A., SeaComm Federal Credit Union, Key Bank, Discover Card, Capital One and NBT Bank, Ms. McDougal said.<br><br>"As far as I know, all of the banks have been cooperating with their customers and all have been reimbursed by their banks or credit card companies," she said.<br><br>"We have a zero loss policy," said Mr. Wilson, of SeaComm Federal in Massena. Under the policy, the credit union absorbs any losses caused by fraud.<br><br>In all, 42 credit union members were among those whose numbers were stolen. All were issued new numbers and cards.<br><br><span style="font-weight: bold;">Commentary:</span><br>I don't get a good feeling about this one.&nbsp; Too many unanswered questions.&nbsp; Nobody seems to know very much.&nbsp; There has been no official public response by WiseBuys.<br><br>NOT FACT, only speculation:<br>I like to speculate, so what the heck I'll throw something out there.&nbsp; I'm going to say that full magnetic stripe data was captured during data transmission and that this is not an inside job.&nbsp; I am also going to say that this was not related to the Hannaford breach.&nbsp; I didn't exactly go out on a limb with my speculation, but I did speculate nonetheless. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/04/26/wisebuys.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Sat, 26 Apr 2008 17:01:56 +0000</pubDate>
      <category domain="http://securityratty.com/tag/credit card">credit card</category>
      <category domain="http://securityratty.com/tag/credit">credit</category>
      <category domain="http://securityratty.com/tag/wisebuys">wisebuys</category>
      <category domain="http://securityratty.com/tag/credit union">credit union</category>
      <category domain="http://securityratty.com/tag/credit union absorbs">credit union absorbs</category>
      <category domain="http://securityratty.com/tag/credit issuer time">credit issuer time</category>
      <category domain="http://securityratty.com/tag/canton wisebuys store">canton wisebuys store</category>
      <category domain="http://securityratty.com/tag/report credit">report credit</category>
      <category domain="http://securityratty.com/tag/credit card companies">credit card companies</category>
      <source url="http://breachblog.com/2008/04/26/wisebuys.aspx">Hundreds of WiseBuys customers are victims of credit card fraud</source>
    </item>
    <item>
      <title><![CDATA[Stolen Wendy's laptop affects 1,092 employees]]></title>
      <link>http://securityratty.com/article/4842a985c79853d999c877db69363506</link>
      <guid>http://securityratty.com/article/4842a985c79853d999c877db69363506</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
12/21/07

Organization
Wendy's International, Inc

Contractor/Consultant/Branch
None

Victims
Wendy's employees

Number Affected
1,092

Types of Data...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/wendys.jpg" align="right" height="129" width="110"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>12/21/07<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.wendys.com/" target="_blank"> Wendy's International, Inc.</a><br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Wendy's employees<br><br><span style="font-weight: bold;">Number Affected:</span><br>1,092<br><br><span style="font-weight: bold;">Types of Data:</span><br>Name, email address, Social Security number, employee identification number, and salary information.<br><br><span style="font-weight: bold;">Breach Description:</span><br>A Wendy's laptop was stolen during a car burglary at a company employee's home on December 1, 2007.&nbsp; The laptop contained sensitive personal information belonging to 1,092 Wendy's employees including Social Security numbers and salary information.&nbsp; The employee reported the theft to Wendy's on December 3rd, and Wendy's reported the breach on December 21st.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://doj.nh.gov/consumer/pdf/wendys.pdf" target="_blank"> New Hampshire Attorney General breach notification</a><br><br><span style="font-weight: bold;">Report Credit:</span><br>New Hampshire State Attorney General<br><br><span style="font-weight: bold;">Response:</span><br>From the official New Hampshire breach notification:<br><br>We are writing to advise you of a recent incident involving the theft of a company-issued laptop containing certain personal information belonging to Wendy's employees.<br><br>On December 3, 2007, we were notified by any employee of a car burglary at an employee's residence on December 1, 2007, which resulted in the theft of a company-issued laptop.<br><br>Several cars in the neighborhood were the subject of break-ins that evening.&nbsp; Accordingly, it may well be that the computer data was not the target of the burglary, that the perpetrators are not aware that personal information in on the laptop, or that they are not sophisticated enough to access the data (the employee's log-in and password are required for traditional access methods, and the information was in a subfolder with an uninformative title).<br><span style="font-style: italic;">[Evan] I can see the logic in this statement, but it doesn't excuse the fact that the information was not well protected.&nbsp; Little (or no) sophistication is required for someone to gain access to the data on the laptop (circumvent the employee log-in) if someone wanted to, and there is little (or no) security in the fact that the information wasn't labeled "identitythiefopenme.xls".</span><br><br>The information included the name, email address, social security number, employee identification number, and salary information<br><br>The total number of affected individuals was around 1092 (U.S.)<br><br>In order to ensure that affected individuals could take immediate steps to protect themselves from possible identity theft or other monetary damage, Wendy's will be sending a communication by first class mail on December 21, 2007<br><span style="font-style: italic;">[Evan] Not really so "immediate", unless 20+ days is immediate.</span><br><br>at this time Wendy's has no specific knowledge that any information contained on the laptop has been accessed or misused<br><br>We are also determining internally whether having that data on the laptop was consistent with Wendy's data security policies and exceptions.<br><span style="font-style: italic;">[Evan] This is the one statement that is the most troubling to me.&nbsp; The letter was written by the Wendy's Chief Information Officer (CIO) and you would think that a person in this position would know without too much investigation.&nbsp; Information security policies must be clear and concise so that all people completely understand them.&nbsp; Avoid gray areas whenever possible and create a policy waiver request and approval process for exceptional circumstances.&nbsp; Policy waivers that are approved (granted) are logged and archived.</span><br><br>If you have questions, please contact your local HR staff member or contact Wendy's International, Inc. Corporate Office at 1-800-443-7266 and when prompted by the automated attendant, dial ext. 8052.<br><br>Please also accept my personal apology for any concern that this situation might create for you.<br><br><span style="font-weight: bold;">Commentary:</span><br>What can you say other than what was already written above.&nbsp; This is another instance of confidential data that was not adequately secured.&nbsp; It baffles me that there is a question as to whether or not the actions that led to this breach are against company policy.&nbsp; If the storage of confidential information on mobile media (thumb drives, CDs, DVDs, laptops, etc.) without encryption (and other controls) is not in policy, it certainly should be!&nbsp; Information security training and awareness also appear to be lacking. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/01/03/wendys.aspx" type="text/javascript" charset="utf-8"></script>
<br>
<br>
<script type="text/javascript"><!--
google_ad_client = "pub-4721162729073131";
google_ad_width = 468;
google_ad_height = 60;
google_ad_format = "468x60_as";
google_ad_type = "text_image";
google_ad_channel = "";
//-->
</script>
<script type="text/javascript">
</script>]]></content:encoded>
      <pubDate>Thu, 03 Jan 2008 11:08:27 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sensitive personal information">sensitive personal information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/information security policies">information security policies</category>
      <category domain="http://securityratty.com/tag/wendy">wendy</category>
      <category domain="http://securityratty.com/tag/breach description">breach description</category>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <source url="http://breachblog.com/2008/01/03/wendys.aspx">Stolen Wendy's laptop affects 1,092 employees</source>
    </item>
  </channel>
</rss>
