Home > Identity Theft > Data Leak at Stem Cell Bank Makes My Blood Run Cold

Comments 3 Comments

The Big Payback

Laptop_Marlon_Bunday_CCFlickrI’ve read a lot of breach notification letters like this one, and the following line has to be one of my favorite passages from any of them:

“Although we do not believe this situation will involve identity theft out of concern and caution we have developed a plan to provide you with additional protection and peace of mind.”

CBR then offers a oneyear membership in the Experian Triple Alert program.

Whew. Now that’s a relief. You are relieved, aren’t you? CBR is banking on the fact that because a computer and other property were stolen from the car, the tapes were not the target of the theft.

Why am I not hearing a collective sigh of relief?

Is there no one willing to jump on the “relief” train?

[Resource: Identity Theft Emergency]

“What happens after one year?” says Ondrej Krehel, Information Security Officer at Identity Theft 911, a Credit.com sister company.  “Once our Social Security number is somewhere out there, it could be hard to prevent ID theft in the future.”

Identities are currency. They are evergreen. Like fine wine they get better with age. The most sophisticated identity thieves understand that oftentimes banking identities leads to greater return than simply running about the countryside opening accounts within days of a breach. Please do not underestimate the fact that once someone with ill intentions gains access to your identity they have an option on your life. The question then becomes “when” and not “if” he or she chooses to exercise that option.


“We very much regret that this situation occurred,” the letter says.

And I am sure they do. I’m just not so sure that when a CBR client suffers a personal identity theft incident that CBR’s regret will be of great comfort to them.

Look, I believe that CBR does important work and have no doubt that they really are horrified by what happened here.  I’ve been tough on them in this column, but in truth they are far from alone. They are simply another Flavor of the Month. Recently, Health Net suffered a data breach involving potentially 1.9 million current and past customers, health care providers and employees. Health Net’s woes represented its second breach incident in 2 years. In 2009, they reported that a hard drive containing financial and medical information on 1.5 million customers had gone astray. This time several servers at a Health Net data center operated by IBM went walkabout. Forgive my disbelief, but how does one lose several servers? Needless to say, several federal and state regulatory authorities—not to mention a fleet load of their clients—were less than amused.

Over the past several years, an enormous number of data breach incidents involving medical providers and facilities have occurred.  It is most curious to me that those who are genuinely dedicated to saving lives are so woefully inadequate when it comes to protecting those very lives from exposure to potential economic, emotional and criminal dislocation.

We are in the process of digitizing millions of medical records so that more and more people will have access to our sensitive personal and medical information in a national effort to make it easier and more efficient to save lives. That is a double-edged sword. Access without appropriate security protocols can easily lead to inappropriate exposure and significant negative ramifications.

For too long business and industry has been more covetous of their trade secrets and intellectual property than the protection of their most precious asset—the personal identifying information of patients, clients, customers and employees.

A few weeks ago, we recognized National Consumer Protection Week. Frankly, every week of the year should be National Consumer Protection Week. Hopefully, every hour of every day we begin to reflect upon ways to better protect the health, safety and welfare of the American public.

I have no doubt that this message has renewed meaning for the folks at CBR. Their clients, the government and the ultimate regulators of the American economic system—class action law suit attorneys—will be watching how this saga unfolds over the next twelve months with great interest.

Image: Marlon Bunday, via Flickr.com

Pages: 1 2

Comments on articles and responses to those comments are not provided or commissioned by a bank advertiser. Responses have not been reviewed, approved or otherwise endorsed by a bank advertiser. It is not a bank advertiser's responsibility to ensure all posts and/or questions are answered.

Please note that our comments are moderated, so it may take a little time before you see them on the page. Thanks for your patience.

  • ann

    I’d like to know why unencrypted personal data like this is leaving the premises.

    “Apparently, a backpack containing three unencrypted storage tapes, a Dell laptop, zip drive and external hard drive was stolen from a CBR employee’s car, shortly before midnight on December 13, 2010 outside of 365 Main Street—a private data center in San Francisco.”

    Yes, I received a letter also…not very happy.

  • Pingback: Data Leak at Stem Cell Bank Makes My Blood Run Cold | Cyber Crimes Unit()

  • Pingback: Empowering You » News about Medical Identity Theft issue #1()

  • Mark

    As a former employee all I can say is “Yeah that sounds about right.” There fear-selling tactics, under-educated employees (most barely holding associate degree from the local community college), no drug-screening policies, aging facilities, and temperamental one-of-a-kind programs (that only two people in the world can reset if they crash) all leave something to be desired. More than 70% of the time when I needed to call the tech support department based in San Francisco, the on-call techie would answer inside a nightclub, intoxicated, and unable to help. Go with a public bank with actual research PhDs that will understand the genetics of cord blood, and with a facility that isn’t based in the ghetto side of Tucson, or at least with a company that doesn’t allow physical drives to leave the property.

    • Mark

      I mean honestly, pull up 365 Main St, San Francisco, CA 94105 on google maps and check out the crappy city parking lot across the street where the robbery was committed and check out how many bars and the popular brewery up the street. I thought I was putting this place behind me until I got a “friendly letter” saying that someone stole my info, but that they would give me a ONE YEAR paid subscription to a credit monitoring company. Thanks a lot CBR your trust breaks more often than your AXP devices.

  • Pingback: umbilical cord stem cells bank | StemEnhance™ and StemFlo™ | Stem Cell Enhancer()

Certain credit cards and other financial products mentioned in this and other sponsored content on Credit.com are Partners with Credit.com. Credit.com receives compensation if our users apply for and ultimately sign up for any financial products or cards offered.

Hello, Reader!

Thanks for checking out Credit.com. We hope you find the site and the journalism we produce useful. We wanted to take some time to tell you a bit about ourselves.

Our People

The Credit.com editorial team is staffed by a team of editors and reporters, each with many years of financial reporting experience. We’ve worked for places like the New York Times, American Banker, Frontline, TheStreet.com, Business Insider, ABC News, NBC News, CNBC and many others. We also employ a few freelancers and more than 50 contributors (these are typically subject matter experts from the worlds of finance, academia, politics, business and elsewhere).

Our Reporting

We take great pains to ensure that the articles, video and graphics you see on Credit.com are thoroughly reported and fact-checked. Each story is read by two separate editors, and we adhere to the highest editorial standards. We’re not perfect, however, and if you see something that you think is wrong, please email us at editorial team [at] credit [dot] com,

The Credit.com editorial team is committed to providing our readers and viewers with sound, well-reported and understandable information designed to inform and empower. We won’t tell you what to do. We will, however, do our best to explain the consequences of various actions, thereby arming you with the information you need to make decisions that are in your best interests. We also write about things relating to money and finance we think are interesting and want to share.

In addition to appearing on Credit.com, our articles are syndicated to dozens of other news sites. We have more than 100 partners, including MSN, ABC News, CBS News, Yahoo, Marketwatch, Scripps, Money Magazine and many others. This network operates similarly to the Associated Press or Reuters, except we focus almost exclusively on issues relating to personal finance. These are not advertorial or paid placements, rather we provide these articles to our partners in most cases for free. These relationships create more awareness of Credit.com in general and they result in more traffic to us as well.

Our Business Model

Credit.com’s journalism is largely supported by an e-commerce business model. Rather than rely on revenue from display ad impressions, Credit.com maintains a financial marketplace separate from its editorial pages. When someone navigates to those pages, and applies for a credit card, for example, Credit.com will get paid what is essentially a finder’s fee if that person ends up getting the card. That doesn’t mean, however, that our editorial decisions are informed by the products available in our marketplace. The editorial team chooses what to write about and how to write about it independently of the decisions and priorities of the business side of the company. In fact, we maintain a strict and important firewall between the editorial and business departments. Our mission as journalists is to serve the reader, not the advertiser. In that sense, we are no different from any other news organization that is supported by ad revenue.

Visitors to Credit.com are also able to register for a free Credit.com account, which gives them access to a tool called The Credit Report Card. This tool provides users with two free credit scores and a breakdown of the information in their Experian credit report, updated twice monthly. Again, this tool is entirely free, and we mention that frequently in our articles, because we think that it’s a good thing for users to have access to data like this. Separate from its educational value, there is also a business angle to the Credit Report Card. Registered users can be matched with products and services for which they are most likely to qualify. In other words, if you register and you find that your credit is less than stellar, Credit.com won’t recommend a high-end platinum credit card that requires an excellent credit score You’d likely get rejected, and that’s no good for you or Credit.com. You’d be no closer to getting a product you need, there’d be a wasted inquiry on your credit report, and Credit.com wouldn’t get paid. These are essentially what are commonly referred to as "targeted ads" in the world of the Internet. Despite all of this, however, even if you never apply for any product, the Credit Report Card will remain free, and none of this will impact how the editorial team reports on credit and credit scores.

Your Stories

Lastly, much of what we do is informed by our own experiences as well as the experiences of our readers. We want to tell your stories if you’re interested in sharing them. Please email us at story ideas [at] credit [dot] com with ideas or visit us on Facebook or Twitter.

Thanks for stopping by.

- The Credit.com Editorial Team