Slashdot Log In
3.9 Million Citigroup Customers' Data Lost
Posted by
timothy
on Mon Jun 06, 2005 11:12 PM
from the gee-maybe-they-should-collect-less dept.
from the gee-maybe-they-should-collect-less dept.
Rick Zeman writes "CNN.com is reporting that United Parcel Service has lost backup tapes containing the identies of 3.9 million Citigroup customers. According to UPS, '... a "small package" containing data storage tapes was lost while being transferred to a credit reporting bureau.' According to Citigroup, they 'included Social Security numbers, names, account history and loan information about retail customers, and former customers, in the United States.'"
Related Stories
[+]
Your Rights Online: PIN Scandal 'Worst Hack Ever' 365 comments
QuietLagoon writes "The evolving Citibank PIN scandal is getting worse with each passing day. Gregg Keizer of TechWeb News writes: 'The unfolding debit card scam that rocked Citibank this week is far from over, an analyst said Thursday as she called this first-time-ever mass theft of PINs 'the worst consumer scam to date.' ... The problem...is that retailers improperly store PIN numbers after they've been entered, rather than erase them at the PIN-entering pad. Worse, the keys to decrypt the PIN blocks are often stored on the same network as the PINs themselves, making a single successful hack a potential goldmine for criminals: they get the PIN data and the key to read it.'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
And what did the UPS guy say? (Score:5, Funny)
They changed their slogan: (Score:5, Funny)
Parent
Re:And what did the UPS guy say? (Score:3, Interesting)
You wouldnt believe the amount of software and infastructue is current being expended to meet this deadline. I'm working on it now, Sounds easy doesnt it? Its not.
Re:And what did the UPS guy say? (Score:4, Insightful)
Parent
Re:And what did the UPS guy say? (Score:4, Funny)
Oh and if they used an open source solution and that got cracked, the fault would also be theirs, and they would also get 500 messages on how they used an older (or newer!) release, or because they didn't use an obscure "x" patch which you can find in "y" page, hosted in some east european country and in a language used only in that country... etc.
Parent
How often does this happen now? (Score:5, Interesting)
Re:How often does this happen now? (Score:3, Insightful)
*blinks* (Score:5, Insightful)
Parent
Re:*blinks* (Score:5, Interesting)
Parent
Re:*blinks* (Score:5, Interesting)
More than likely they paid a consultant $3.5 million dollars to setup a secure backup system which would work flawlessly. Bought it. Installed it...
And then new IT director-minion-worked-at-walmart-last-week went in to "optimize" the server and kill any "useless" processes that were making it run slow, and killed the encryption process.
And then of course they backup for two years without encryption until they hire a $8 an hour "casual" to "catalog" and "clean up" the archives -- and he discovers that they aren't encrypted. Notifies his boss who really doesn't understand -- and nothing happens.
And then they have a security breach and are "caught off guard". Heads roll, new consultants are hired, and the process begins again.
Well, at least that's what seems to happen where I work.
Parent
Re:How often does this happen now? (Score:3, Insightful)
-John
Re:How often does this happen now? (Score:3, Interesting)
In this case, the lost cargo is probably in a UPS warehouse somewhere. They probably ran over the cargo with a forklift, and it's currently unidentifiable.
See http://www.perkinscoie.com/content/ren/updates/eco mm/062703.htm [perkinscoie.com] for more info on the CA law.
Re:How often does this happen now? (Score:3, Insightful)
Doesn't even one of them think for a moment - "Huh? I wonder what we are doing to make sure that this doesn't happen to us?"
I'm not one for endorsing additional legislation - but perhaps if we held officers liable (SarbOx style maybe) for these breaches, then maybe someone will start to care.
Unacceptable (Score:5, Insightful)
Re:Unacceptable (Score:5, Insightful)
So what is your solution? (Hint: YMFL, (Yet More Federal Legislation), will not prevent accidental loss of freight packages).
BTW - I write this as someone who has a mortgage with Citigroup so my data could be at risk here. However, my knee is not jerking violently, (yet).
Parent
Re:Unacceptable (Score:4, Insightful)
So you want to pass a law that is unpopular?
Problem.
Reaction.
Solution.
It's called Diocletian's Problem. [propagandamatrix.com]
Parent
Re:Unacceptable (Score:5, Insightful)
You can't, but you can make the things that tend to lead to accidents illegal. You'll notice there's no law against getting into a car crash, but there are lots of laws about driving too fast, running red lights, driving drunk, unsafe lane changes, etc etcet c.
Same idea here. If I can be fined for driving 100mph because it might cause an accident, Citibank should be able to be fined for sending unencrypted data via UPS because it might cause an accident.
Parent
They Can Be Fined.. (Score:5, Informative)
They can be. GLBA, as it's known in the financial services circles, requires any financial institution to design, implement, and maintain controls to protect customer confidential data, which it appears is what was lost. Whether it's an audit trail for a system running on the network, or encryption when travelling on an unprotected network, GLBA dictates that the highest level of care be used when handling customer data. It is something that we in the banking world take very, VERY seriously.
If they so chose, the FTC, the OCC, the SEC, the CFTC, or state insurance regulators could fine Citigroup for violations of GLBA.
Parent
Re:Unacceptable (Score:3, Insightful)
Re:Unacceptable (Score:3, Insightful)
Whatever dude, I think it's time to take off your blinderes.
Re:Unacceptable (Score:3, Insightful)
Statement (Score:3, Funny)
Employee: Ummm, let me verify that with my datab... I mean.... let me get my manager.
Customer: No problem. Take your time. Would you like some free coffee. It's on me.
Gives new meaning to their slogan (Score:5, Funny)
Support legislation for criminalization of this (Score:5, Insightful)
Re:Inappropriate for your bank to have your info? (Score:3, Informative)
remember folks (Score:5, Insightful)
is it hot in here? (Score:5, Funny)
Sensitive Data via UPS? (Score:5, Insightful)
Re:Sensitive Data via UPS? (Score:3, Interesting)
>
You obviously have zero experience in the shipping field despite your claim to have worked for UPS. It isn't uncommon at times to have 100 times that percentage of packages lost or damanged by us. We are a union shop so the lazy thugs we have can get away with anything. For example at the terminal where I work, a local jewelry store went out of business and shipped-out about four dozen nice
Re:Sensitive Data via UPS? (Score:5, Funny)
Parent
Is it really lost? (Score:4, Insightful)
I never really understood why they called it identity theft. Much like I can't understand why they call it "stealing" music. Nothing's actually gone -- it's really more of an identity infringement.
Attach a cost to lost data (Score:5, Insightful)
I expect this will take a big class action lawsuit, but if I were a company of any size which handled confidential client data, I would be scrambling for a way to reduce my liability.
Data separation (Score:4, Interesting)
Has It Always Been this Bad? (Score:3, Insightful)
Nice to know where their priorities lie (Score:5, Insightful)
Re:Nice to know where their priorities lie (Score:3, Insightful)
Re:Nice to know where their priorities lie (Score:5, Insightful)
Well, that is because credit card companies don't care about you on a cosmic level. Damn right they never cared about your data. Hell, they sold it to every company on the planet already!
Why would they? What are you going to do? "Cancel your card? YOU HAVE A BALANCE! MUAAHHAHAHHHAHA! Fraud you say? Yeah, right! I don't care if you have Cancer, get back to work you deadbeat."
Most of America is in a you're-screwed-bonus-round with these jackasses. They give a crap about your data. These are the same generous, kind, and loving souls that sold you out to begin with. Everybody at light-my-fart.com got your name and address from them, why shouldn't they just get the freakin' credit card numbers, too?
Credit card companies are the big banking's little thugs.
Q: What's the difference between a credit card company and a loan shark?
A: Loan sharks tell you up front what they're going to do if you don't pay up.
Look, they never cared. They might feel bad, but I guess they feel bad about it in the same way that Satan would feel bad about killing children in a freeway pileup. "Whoops! *Chuckle*!"
Nothing punitive is ever going to come of this. If you have any doubts, recognize this:
Didn't our wonderful President just sign a bill for you to never be able to declare bankruptcy, even if you get freakin' terminally ill? I wonder who wrote that gem of a law for the people? Hmmmm. The President could give you a NO THANK YOU option on Social Security for the generations that will get nothing. That didn't happen. He wants to FORCE you to put your social security money in a special PRIVATELY OWNED BANK right now, in a way that you can never touch it. Wow. Who put that racket together?!? He's spending every waking moment touring the country supporting that agenda! Golly Gee whiz, I wonder who helped him see the light on that? I for one, trust our corporate masters. They would never screw us over. Never.
Trust me. Nothing will ever come of this. You have been warned.
Parent
i hope everyone that is a citibank customer (Score:3, Insightful)
i am moving from BofA after their mishap.
Somewhere smaller, hopefully more secure.
Hit them where it hurts!!!!
Were the tapes encrypted? (Score:3, Insightful)
You break it, you buy it. (Score:5, Insightful)
Re:You break it, you buy it. (Score:5, Informative)
Parent
citibastards and a possible solution (Score:3, Insightful)
There is definitely something wrong with this system! I'm all for doing without consumer credit, but it's simply not feasible.
Perhaps we need a public-key style scheme where we generate a unique private key that we use to encrypt things like credit card applications, and then the public key is on file with the government and credit card companies and the like. That way only we have access to important private information, but the credit reporting agencies and the government can still keep track of us the way they do currently.
This would beat the hell out of biometrics and nonsense like that (you can't bloody send someone a retina scan over the internet or through the mail!), and it would do something to improve our privacy by preventing people from faking your identity.
Obvious (Score:5, Funny)
Find Results With
The exact phrase high security
Search for "high security" found 0 matches.
As a UPS employee... (Score:4, Informative)
Lost? (Score:3, Insightful)
Isn't this the second time (or more, most likely) that a set of shipped customer has been "lost?"
It's quite possible that the scum of the universe that feeds on harvested identities has gotten sophisticated enough that they are now able to identify such in-transit packages and have them go missing.
Bottom line -- companies should not be shipping this type of information via common carriers.
Lecture Time (Score:5, Insightful)
And then, just to make the point, they should have to pay not just whatever court-assessed penalties, but that amount plus 24.99% retroactively applied to the entire amount backdated from the time they finally pay all the way back to the time of the incident, just like they're always raising people's interest rates to unreasonable amounts like that even retroactively on purchases already made, and to ensure that they pay in a timely way.
And it goes without saying that reparations should be paid personally by the people who run the company, not passed along to customers.
Re:Lecture Time (Score:5, Informative)
It never occurs to anyone that the Bank, and not me, might be the one who didn't like their end of the contract...
I I got an adverse credit report and they raised my interest. The nature of the adverse report? I had used my card.
Yes, they give you cards at a certain interest rate and if you've never seen it happen, you can use them responsibly, make your payments, etc. and still end up with a "too much unsecured credit" marker from the credit agencies because they decide (after issuing the cards, when they realize you're going to use them) that you borrowed too much (i.e., that they offered you more credit than they meant to). They don't frame it (as they should) as "oops, we didn't mean to authorize that card. They think it's my burden to keep track of that, I guess. And I thought it was just my burden to make the payments.
Have I failed to keep my credit current? Nope. I managed to keep up to date even with the near crippling interest rates. But I did my financial planning based on the smaller interest rate they had originally negotiated with me, not realizing I'd be a bad customer by merely using my cards. I just had some intermediate bloat while I waited to sell my house and needed a large amount of short-term credit to cover some upgrades on the house while it was preparing for sale. I saw my rates jump from single-digits into the 20's.
Why did they do it? Because their economic models said I was a risk and because they could. But then, with all that personalization (by which they mean a "photo on the card") it never occurred them to just call me and talk to me about what was going on in my life and to find out why my balance was high. Some personalization.
First USA (bought by BankOne, then bought by Chase) and MBNA are the absolute worst. Citibank and Sears were intermediately aggressive. They're all suddenly calling me a valued customer and offering me single digit rates again now that my house got sold and I paid some of it back down.
They spend tons of money trying to detect bad customers. They spend nothing trying to detect good customers. You're right I'm bitter.
But, just to stay on topic (which your uninformed, ad hominem attack on me was not, IMO), my real point is that the credit card companies behave in a routinely holier-than-thou way about everything they do involving money, while they soak the public for infinite money. Then on top of large profits, they ask a Republican Congress for a change to the bankruptcy bill because they allege they are being soaked by bankruptcies, even though they're seeing huge profits even before the changes. To listen to these megabanks, they are the victims and we the public are the powerful perpetrators. I just don't see it. So I see no reason not to be quite harsh with them when they screw up.
Parent
Dear CITIGROUP Custoomer... (Score:3, Funny)
Tahnk you 4 ur help in tihs imprtnt matter
Signed, CITIGROUP
makes me wonder why i even try (Score:3, Interesting)
- stolen from saic
- illegaly sold by bank of america
- lost by citibank
awesome! thanks a lot guysNothing so paranoid as an ex-C-bank employee... (Score:4, Insightful)
What, you think there's something special about C-bank? No, they're the rule, not the exception. Every financial institutions cares just about the same amount about your data, and your life - in fact, the only money they really watch out for is the huge sums the company gets to keep for itself - THAT money (and the company's data) gets MUCH more carefully guarded!
My rule these days is, giving away information that you don't have to is like giving whiskey and car keys to a teenager. So apply for the credit card, but just write "disconnected" in the phone number box. Use several free email addresses and make sure they're evenly distributed as contact drops. Make a "mistake" in estimating your exact gross annual income, when reporting it to anybody but the IRS.
The point is not to be subversive, but just to be realistic. The information age has spawned a paper-happy beuracracy driven by bean-counters who want you life history at every other step. Check it yourself - 90% of the data that you go though life writing in little boxes is simply dropped into a filing cabinet unread, unneeded, and ignored. I've gotten driver's licences with no address (just a PO box!), paycheck stubs with no SS number on them (you can ask to get it removed), and once got Household Credit to approve "Barney the Purple Dinosaur" for a credit line of $250. (To the best of my knowledge, the address I did this at *still* gets offers for him...)
Most of the people who key the data from your form to the computer do not even speak English! In fact, the most likely method for your data to be read is for the processing center to OCR-scan (or flat picture scan) it into a computer, where the images can then be beamed to the lowest-bidding Malaysian crack monkey (anywhere in the world) who "reads" the picture of your data and keys it in. And they're feeling the pressure from machine-AI reading programs, which are able to translate more and more of your hand-writing with a higher percent-chance of confidence every day.
Bottom line, if you throw a "Jr" onto your name half the time and half not, or only use your middle initial as the fancy strikes you, you're lying to no-one but an SQL database app, and you're only doing what little is in your power to confuse would-be identity thieves; necessary in a world that will always refuse to protect you!