Tuesday, January 22, 2008

Iron Mountain Not So Invincible After All...

I'm sure many JC Penney credit card holders read the news of the 'loss' of a tape containing information on tens of thousands of JCP customers, some including their SS numbers.

Hardly a month goes by without mention of at least one MAJOR breach (and who knows how many of these go unreported), so the important thing here is for the general public not to get jaded and let these things slide. The right thing to do for the various consumer groups is to get together and form a united front in pushing the govt to pass STRONG and EFFECTIVE consumer protection laws.

Yes, GE Money will offer a year's worth of ID monitoring for those that had their SS lost, but who's to say what'll happen after 1 year? SS numbers are permanent unless you have a VERY good reason to request a new one (Witness Protection Program, shelter from an abusive spouse etc), so how does one escape this?

The cleanest way to protect your id is not to apply for credit cards (just have a max of 2 for convenience and an emergency backup) and pay CASH everywhere. No wonder they say cash is king! Every year check out your credit report for free from each of the reporting agencies and spread it around so that you do it every 4 months (e.g. first from Equifax, second from TransUnion, and third from Experian). That way you have the entire year covered and can check for incosistencies and errors - and any fraudulent activities as well.

You'd think companies that store information for others would have a process in place to avoid just these kinds of incidents. That they'd have a tracking mechanism to identify the 'chain of trust' or the breadcrumb trail of what went where and why. I'm quite surprised that a tape (not a tiny floppy, you know) could just VANISH with nobody having any idea of where it may have gone.

To their credit, they do handle millions of items, so things may get 'lost' every now and then, but that again raises the question - that's precisely why customers invest in such methods for backing up and storing their critical data - that why should a company spend so much money on a backup solution that could go wrong? I guess one of the criteria in selecting a backup vendor would be to look at their processes (and audit them via third-party if the contract allows - or just make it a requirement) to see how it compares with other companies, and maybe their record as well.

Be safe!