Posts Tagged ‘Social Security number’

Citibank victimized by hackers, insists cardholders are safe

Published by pratyushkp on June 9th, 2011 - in Social, Technology

Image by Getty Images via @daylife

Reuters is reporting that Citibank‘s systems were hacked, resulting in a loss of Personally Identifiable Information (PII).

Citibank says that data for 1% of their cardholders was accessed through this breach, but customers‘ Social Security Numbers (SSNs), birth dates, card expiration dates and CVV codes are safe.

Information that may have been disclosed to the hackers includes customers’ names, account numbers, contact details and email addresses.

According to Citibank’s website they are the world’s largest provider of credit cards, issuing more than 150,000,000 cards globally. Based on these numbers, information for 1,500,000 or more individuals may have been compromised.

In April Paul Gaulant, former head of the bank’s credit card unit, told Reuters, “Security breaches happen, they’re going to continue to happen … the mission of the banking industry is to keep the customer base safe and customers feeling secure about their financial transactions and payments.”

That may be true, but feeling secure is not the same as being secure. How this information was acquired and why it wasn’t protected against theft is a far more important question.

Citi has stated they will notify customers believed to be affected by the breach.

Customers affected by this incident should be on high alert for scams, phishing and phone calls purporting to be from Citibank and their subsidiaries.

While Citi customers aren’t likely to have fraudulent charges against their accounts as a result of this breach, they are likely to encounter social engineering attempts to enable further crime.

Considering that the attackers have your name, account number and other sensitive information they are able to provide a very convincing cover story to victims.

Never accept incoming communications purporting be from financial institutions you do business with, whether by email or phone call. Call them back using only the phone numbers published on your cards or statements. When logging in to perform online transactions, always enter their website address directly in your browser. Never click links.

Source :- http://nakedsecurity.sophos.com

  • Citibank Reveals Massive Data Breach (newser.com)
  • Citibank hacked, 1.5 million customers information may be at risk ~ Softview (softview.co.in)
  • Citibank the latest to suffer successful hack (electronista.com)
  • Citi admits hackers stole data on 200,000 card holders (slashgear.com)
  • Bank Of America Settlement In Debit Card Litigation (businessinsider.com)
  • Tips for Protecting Yourself from Identity Theft (savings.com)

President Obama’s cybersecurity plan – Part 2 Data Breach Notification Act

Published by pratyushkp on May 19th, 2011 - in Social

Image via Wikipedia

Following up on yesterday’s post outlining the proposed changes to RICO and the Computer Fraud and Abuse Act, today I will dissect the White House’s proposal for the National Data Breach Notification Act.

Currently 47 states have data breach notification laws with varying rules and requirements. This makes it very difficult for national and multinational organizations to understand when they must report lost or stolen data and how they must report it. The idea of a national law in the US has been debated for a couple of years now, and this proposal seems to strike a nice balance.

First, the definition of Personally Identifiable Information, or PII:

  1. Full name plus any two of the following
    1. Address and phone number
    2. Mother’s maiden name
    3. Month, day, and year of birth
  2. Social Security Number (SSN), driver’s license number, passport number, alien registration number, or other government issued identification number
  3. Biometric data such as fingerprints, retinal scans, etc.
  4. Unique account numbers, financial account numbers, credit card numbers, debit card numbers, electronic IDs, user names or routing codes
  5. Any combination of the following
    1. First and last name or first initial and last name
    2. See item four above
    3. Security codes, access codes, passwords or source codes used to derive the aforementioned

The new rules would apply to any business possessing the PII of 10,000 or more individuals in a 12-month period. They would supersede any existing state laws, creating one unified national standard.

Organizations discovering lost or stolen PII would have 60 days to notify affected customers unless law enforcement or national security concerns intervene. If there are extenuating circumstances, organizations can provide proof to the Federal Trade Commission (FTC) that they require up to an additional 30 days.

The proposal includes a “safe harbor” provision when measures are in place to protect data (encryption). Organizations must still report the data loss to the FTC within 45 days, including a professional risk assessment, logs of access to the data and a complete list of users who had access to the protected data.

If data is determined to be properly protected and evidence is submitted on time, individual notifications would be unnecessary. Financial institutions who only lose account numbers are also exempt if other protective measures are in place to prevent fraud.

After a data loss incident, organizations would be required to notify individuals by letter, phone or email.

Notices would include what information was compromised and a toll-free number to contact the company responsible to obtain more information. If a third party lost the data, the notice must include the name of the original collector (direct business relationship) of the PII.

States may pass laws requiring notifications to include information about identity theft/fraud prevention.

When more than 5,000 victims are involved, organizations would be required to do the following:

  • Place advertisements in mass media ensuring potential victims are aware of the risk they are being exposed to.
  • Notify all consumer credit reporting agencies of the victims within 60 days of discovery.

Businesses would be required to notify the Department of Homeland Security for law enforcement purposes when any of the following are true:

  • The breach contains, or is believed to contain, PII on 5,000 or more individuals.
  • The breach involves a database or network of databases that contain PII on 500,000 or more individuals.
  • The breach involves a database owned by the United States government.
  • The breach involves PII of employees or contractors of the United States government involved in law enforcement or national security.

Notice to DHS must occur 72 hours before individual notices are served, or 10 days after discovery of the incident, whichever comes first.

The proposed rules would be enforced by the FTC after consultation with the US Attorney General to ensure there is no interference with ongoing criminal investigations. State Attorneys General would also be able to enforce the rules within their jurisdiction after notifying the FTC.

Penalties for non-compliance would be $1000 per person affected per day, for a maximum of $1 million. There would not be a maximum penalty if it is determined the non-compliance was willful or intentional.

Organizations that are required to comply with HIPAA or HITECH data protection laws are exempt from this legislation.

It appears the Obama Administration and Howard Schmidt, the President’s Cyber-Security Coordinator, have taken careful notes from the different laws passed by individual states. This proposal is a great start to making data security a priority and contains provisions to make adjustments after implementation.

Why not download the “The State of Data Security” report we published today? It covers the most prominent data loss incidents and details the actions you can take to prevent you from being the next company to have to notify your customers.

Source :- http://nakedsecurity.sophos.com

  • White House Seeks National Data-Breach Notification Law (informationweek.com)
  • The U.S. Cyber Policy Blitz (technologyreview.in)
  • White House Wants Mandatory 3-Year Sentence for Critical Infrastructure Hackers (wired.com)
  • Does Obama Really Have an Internet Kill Switch? (pcworld.com)
  • How security chief’s bank details leaked (theage.com.au)
  • How big was the Epsilon data breach? (superconductor.voltage.com)
  • Five things companies must do to protect customer data (news.consumerreports.org)
  • U.S. Cybersecurity Proposal – A Plan about Plans: We Need More Action and Talent If We’re Serious about Securing Our Nation’s Data (lumension.com)
  • White House Releases Cybersecurity Plans (informationweek.com)
  • Is Sony Getting a Bad Rap on Its Data Breach? (pcworld.com)
© Social Media Blog