Identity Theft

Data Leak at Stem Cell Bank Makes My Blood Run Cold

Comments 3 Comments

The Big Payback

Laptop_Marlon_Bunday_CCFlickrI’ve read a lot of breach notification letters like this one, and the following line has to be one of my favorite passages from any of them:

“Although we do not believe this situation will involve identity theft out of concern and caution we have developed a plan to provide you with additional protection and peace of mind.”

CBR then offers a one-year membership in the Experian Triple Alert program.

Whew. Now that’s a relief. You are relieved, aren’t you? CBR is banking on the fact that because a computer and other property were stolen from the car, the tapes were not the target of the theft.

Why am I not hearing a collective sigh of relief?

Is there no one willing to jump on the “relief” train?

[Resource: Identity Theft Emergency]

“What happens after one year?” says Ondrej Krehel, Information Security Officer at Identity Theft 911, a Credit.com sister company.  “Once our Social Security number is somewhere out there, it could be hard to prevent ID theft in the future.”

Identities are currency. They are evergreen. Like fine wine they get better with age. The most sophisticated identity thieves understand that oftentimes banking identities leads to greater return than simply running about the countryside opening accounts within days of a breach. Please do not underestimate the fact that once someone with ill intentions gains access to your identity they have an option on your life. The question then becomes “when” and not “if” he or she chooses to exercise that option.

Sorry!

“We very much regret that this situation occurred,” the letter says.

And I am sure they do. I’m just not so sure that when a CBR client suffers a personal identity theft incident that CBR’s regret will be of great comfort to them.

Look, I believe that CBR does important work and have no doubt that they really are horrified by what happened here.  I’ve been tough on them in this column, but in truth they are far from alone. They are simply another Flavor of the Month. Recently, Health Net suffered a data breach involving potentially 1.9 million current and past customers, health care providers and employees. Health Net’s woes represented its second breach incident in 2 years. In 2009, they reported that a hard drive containing financial and medical information on 1.5 million customers had gone astray. This time several servers at a Health Net data center operated by IBM went walkabout. Forgive my disbelief, but how does one lose several servers? Needless to say, several federal and state regulatory authorities—not to mention a fleet load of their clients—were less than amused.

Over the past several years, an enormous number of data breach incidents involving medical providers and facilities have occurred.  It is most curious to me that those who are genuinely dedicated to saving lives are so woefully inadequate when it comes to protecting those very lives from exposure to potential economic, emotional and criminal dislocation.

We are in the process of digitizing millions of medical records so that more and more people will have access to our sensitive personal and medical information in a national effort to make it easier and more efficient to save lives. That is a double-edged sword. Access without appropriate security protocols can easily lead to inappropriate exposure and significant negative ramifications.

For too long business and industry has been more covetous of their trade secrets and intellectual property than the protection of their most precious asset—the personal identifying information of patients, clients, customers and employees.

A few weeks ago, we recognized National Consumer Protection Week. Frankly, every week of the year should be National Consumer Protection Week. Hopefully, every hour of every day we begin to reflect upon ways to better protect the health, safety and welfare of the American public.

I have no doubt that this message has renewed meaning for the folks at CBR. Their clients, the government and the ultimate regulators of the American economic system—class action law suit attorneys—will be watching how this saga unfolds over the next twelve months with great interest.

Image: Marlon Bunday, via Flickr.com

Pages: 1 2

Please note that our comments are moderated, so it may take a little time before you see them on the page. Thanks for your patience.

  • ann

    I’d like to know why unencrypted personal data like this is leaving the premises.

    “Apparently, a backpack containing three unencrypted storage tapes, a Dell laptop, zip drive and external hard drive was stolen from a CBR employee’s car, shortly before midnight on December 13, 2010 outside of 365 Main Street—a private data center in San Francisco.”

    Yes, I received a letter also…not very happy.

  • Pingback: Data Leak at Stem Cell Bank Makes My Blood Run Cold | Cyber Crimes Unit

  • Pingback: Empowering You » News about Medical Identity Theft issue #1

  • Mark

    As a former employee all I can say is “Yeah that sounds about right.” There fear-selling tactics, under-educated employees (most barely holding associate degree from the local community college), no drug-screening policies, aging facilities, and temperamental one-of-a-kind programs (that only two people in the world can reset if they crash) all leave something to be desired. More than 70% of the time when I needed to call the tech support department based in San Francisco, the on-call techie would answer inside a nightclub, intoxicated, and unable to help. Go with a public bank with actual research PhDs that will understand the genetics of cord blood, and with a facility that isn’t based in the ghetto side of Tucson, or at least with a company that doesn’t allow physical drives to leave the property.

    • Mark

      I mean honestly, pull up 365 Main St, San Francisco, CA 94105 on google maps and check out the crappy city parking lot across the street where the robbery was committed and check out how many bars and the popular brewery up the street. I thought I was putting this place behind me until I got a “friendly letter” saying that someone stole my info, but that they would give me a ONE YEAR paid subscription to a credit monitoring company. Thanks a lot CBR your trust breaks more often than your AXP devices.

  • Pingback: umbilical cord stem cells bank | StemEnhance™ and StemFlo™ | Stem Cell Enhancer

Find out where you stand.
Get your FREE personalized credit report card.

Sign Up Now
X

Stay Connected to Our Experts

Please submit your email address to get credit & money tips & advice
from our team of 30+ experts, delivered weekly to your inbox.