Today I read in the Chicago Sun-Times that CS Stars (not sure this is the same organization's website, but it appears as though it could be), a contractor for the state of New York, could not locate a personal computer New York State provided to them which contained the names, addresses and Social Security numbers "of as many as 540,000 injured workers."

"CS Stars had been using the computer to move the data from the state to the company's computerized claim system, according to the letter."

CS Stars is based in Chicago but also has an office in New York.

This story brought many questions to mind...

• Were they sending the data by physically taking it on a computer because they thought this was more secure than sending it electronically?
• The article indicates it was missing from "a secure facility of the company," so it appears it was not lost while in transit.  Wonder what constitutes a "secure facility"?  The front door is locked?  A locked desk drawer?  A facility with guards, two-factor authentication to get in the door, and surveillance cameras?  It is always interesting to read these reports of security incidents and see the terminology used.  A secured facility is very subjective and could mean a very wide spectrum of things.
• If the facility was such that only authorized people had access to the computer, then it is likely the theft (if it was a theft and not just a misplaced computer now stuck under someone's desk to prop up their feet, perhaps) was done by an insider.  This would make the data more likely to be at risk if the person knew the type of data on it and planned to use it to commit some potentially lucrative cybercrime.

This story coincidentally came out after I had just visited the Identity Theft Resource Center where they reported "In 2005 there were 151 incidents affecting more than 57.7 million people. Approximately half of the breaches were educational institutions. 16% were banking, credit or financial services. We are tracking 2006 currently. As of the end of April there were nearly 80 large breaches."

Information from the FTC and the Secret Service/CERT Insider Threat Studies show how vulnerable information is to being compromised by insiders with authorized access. 

It will be interesting to see if any more is published about this investigation, and if it was an inside job.

Technorati Tags
information security
IT compliance
cybercrime
insider threat
lost computer
personal information breach
privacy breach
policies and procedures
awareness and training
privacy