Like many kinds of loss, massive data  loss has phases. The phase after "our data is missing but there's no danger" is often "the loss is worse than we thought." The theft of Ohio state government data, first announced last week, has moved into the second phase with the announcement on Wednesday that it includes confidential information for up to 225,000 taxpayers.
Last week, Governor Ted Strickland announced that Social Security numbers and other confidential information for all 64,467 employees of the Ohio state government had been stolen. The data was stored on a device presumably stolen from a state intern's car on June 10.
The governor said at the time that the device, of an unspecified type, required "special equipment" to be accessed, and there was "no reason to believe a breach of information has occurred."
Now it appears that the device also contained the names, Social Security numbers, and other information of various nongovernmental Ohio residents who were on lists, in many cases because they had not cashed checks the state had sent them.
The List Goes On
As with the affected state employees, Strickland is making available to those 225,000 taxpayers a free identity-theft protection service and access to an online database, at www.ohio.gov/idprotect, to see if they're on the device.
Ohio officials now say that the device included a list of taxpayers who had uncashed refund checks for state personal income taxes or school district income taxes, from 2005 to May 29, 2007. The bad news is that it included their names and Social Security numbers, as well as the check amounts. The good news is that it did not contain mailing addresses or bank account information.
For 602 state lottery winners who thought they were lucky, but who had not yet cashed the check for their lottery win, there was some unlucky news. The lost device contained a file with their names and Social Security numbers.
In addition, there was a list of names and Social Security numbers for 2,488 Ohioans who had not cashed checks for unclaimed funds payments, and the names and bank account numbers for as many as 1,000 Electronic Funds Transfers that were uncompleted.
Under Investigation
The exact nature of how the loss occurred is under investigation by the Ohio Highway Patrol, as is the intern involved. According to the state, the storage device was not a laptop, although officials are deliberately not providing detailed information.
Ohio procedures dating back to 2002 have allowed for backup storage at a work-site computer, such as the interagency project computer that the intern was reportedly working on, and another backup to be taken home by employees on a rotating basis for safekeeping. The Governor said last week that it was inappropriate for the data to have been given to an intern.
When the data loss was revealed late last week, Strickland also announced that he is changing state procedures for how such personal data is managed. For instance, employees are no longer allowed to take a storage device home, and a second backup will be locked in a fireproof box at another location.
|
Rackspace: It makes a difference when you focus on support.
House Lawmakers Push Ban on Peer-to-Peer Software
GAO: Los Alamos Computer Security Has Weaknesses
Computer Security Firm Fortinet Plans IPO This Week
Flat Shipments Hurt Dell Despite Increased Earnings
New Pogoplug 'Personal Cloud' Does Social Networking
Apple Tablet Rumored Delayed as Publisher Gears Up
Smartphones: A Bigger Target for Security Threats
FBI Says Hackers Targeting Law Firms, PR Companies