The database compromise club has a new member. Mazel Tov, Cord Blood Registry. You are the latest organization to fail in your responsibility to your clients by neglecting to provide even minimal security for their personal data. Your membership card is in the mail.
Who is CBR?
Before diving into the data leak, let’s learn a bit more about Cord Blood Registry. CBR is perhaps the world’s largest stem cell bank storing more than 350,000 cord blood collections for individuals and their families.
As my Credit.com colleague Chris Maag wrote: “The Cord Blood Registry saves stem cells from umbilical cords, which is useful in treatment for sickle cell anemia, and in transplant surgeries to minimize the risk of new organs getting rejected by the body. Researchers are studying other potential uses, including regenerating cells to repair damaged tissue.”
[Article: Big Data Breach at Sensitive Lab Prompts Credit Scare]
They claim to be the biggest and “baddest” at what they do.
“Our 80,000 square foot laboratory is the largest cord blood processing facility in the world with some of the most advanced technology in the industry.”
You can rely on our experience and expertise for your family.
But based on what they lost, how they lost it, when they lost it, the timing and way they explained it, it’s obvious that they have some serious work to do if they want to regain their clients’ trust.
OOPS!
300,000 CBR clients received this belated Valentine’s Day card from David Zitlow, Executive Vice President for External Affairs. It opens with the following:
“I am writing to let you know that an incident occurred that may lead to personal information about you being exposed.”
The personal information referenced is of a demographic and financial nature. Translation: names, Social Security numbers, driver’s license numbers, credit card numbers and credit card expiration dates.
Apparently, a backpack containing three unencrypted storage tapes, a Dell laptop, zip drive and external hard drive was stolen from a CBR employee’s car, shortly before midnight on December 13, 2010 outside of 365 Main Street—a private data center in San Francisco.
[Free Tool: Obtain your Identity Risk Score from Credit.com]
According to a story on Health Data Management, CBR did not immediately post information about the breach on their site and it took them several weeks to get the word out to their client base.
As reported by Paul NcNamara in Buzzblog, Kathy Engle, CBR’s director of corporate communications told him that clinical data was not breached—in other words, a hacker wasn’t able to get through their security protocols. That’s the good news … kind of. For the 300,000 whose information was compromised, the manner of leak is not nearly as important as the fact that it happened in the first place. And as far as I’m concerned, the fact that the data was neither encrypted nor locked in a secure environment (a car trunk is not a secure environment) is just plain nuts. When it comes to data security, that’s the bare minimum.
“Keeping your personal information secure is of the utmost importance to us,” the letter reads.
Sure it is. That’s why the names, addresses, Social Security Numbers, credit card numbers and credit card expiration dates of some 300,000 clients was neatly packed in a backpack in the back of a “locked” car in San Francisco. I guess someone exercised some degree of care—I mean the car might have been left unlocked.
The letter goes on to say:
“CBR also brought in computer security experts to evaluate potential risks. Our experts have advised us there is no indication that any of your personal information has been accessed or misused.”
It should really read, “… no indication that your personal information has been accessed or misused yet.” The information is out there. It’s been in the press. Rest assured, somewhere out there identity thieves are making inquiries.
But the best is yet to come.
Image: Xenïa Antunes, via Flickr.com
You Might Also Like
Find out what someone can do with your stolen Social Security num... Read More
October 19, 2023
Identity Theft and Scams
The Federal Trade Commission’s Consumer Sentinel Network re... Read More
May 17, 2022
Identity Theft and Scams
COVID-19 vaccines are being rolled out across the country, and th... Read More
May 20, 2021
Identity Theft and Scams