Wells Fargo's Laptop Loss the Latest

Missing Machine Contains Data on Thousands of Bank Customers

By Martin H. Bosworth
ConsumerAffairs.com

May 15, 2006
What's more common than a scandal in Washington? Laptop thefts. It seems that a month can't go by without a report of some company employee losing or being robbed of a laptop containing personal data on thousands of people.

Wells Fargo is the latest. On May 5th, the financial services firm reported that a laptop containing data on customers from its mortgage division "[had] been reported as missing and may be stolen."

The computer contained information on current and prospective Wells Fargo customers, including names, addresses, and Social Security numbers.

The company claims that the data on the computer was under "two layers of protection," and that the theft was for the hardware, not the data.

As in most cases of data breaches, Wells Fargo offered free credit monitoring for affected customers, who didn't receive formal notice of the breach until as long as two weeks after it was reported.

Information technology news site The Register reported that one individual affected by the Wells Fargo laptop loss was part of a previous data breach.

The unfortunate soul was an employee of Hewlett-Packard, one of 200,000 whose data was on a laptop stolen from an office of Fidelity Investments in April 2006.

The Register published a series of investigative articles on how high-priced accounting firm Ernst & Young lost a laptop containing data on thousands of employees from several different companies, including Sun Microsystems, Cisco Systems, BP (formerly British Petroleum), and IBM.

Ernst & Young did not publicize details of the theft, nor publicly admit to it, until Register reporter Ashlee Vance repeatedly queried them about it.

In an April essay on the rising trend of laptop thefts, The Register's John Leyden discussed how weak user passwords and easily available hardware tools could combine to crack most levels of security on laptops.

"Firms should avoid setting up machines that can be booted from USBs, floppy discs, CD ROMs or from a network," he said. "Strong passwords contained a mix of alphanumeric characters should be used."

In addition to using stronger encryption techniques and more complex passwords, employees need to take greater care of where they physically keep laptops. Companies should also institute much stronger policies regarding what data can be taken offsite and for how long.

Victims of laptop theft, like any other data loss, need to take proactive precautions in order to safeguard their personal information.

In addition to putting fraud alerts on their credit reports and notifying their banks and other lenders about the issue, they need to investigate the offers of "free credit monitoring" to ensure they aren't signed up for a paid service without their consent.

Report Your Experience
If you've had a bad experience -- or a good one -- with a consumer product or service, we'd like to hear about it. All complaints are reviewed by class action attorneys and are considered for publication on our site. Knowledge is power! Help spread the word. File your consumer report now.

Follow us on Twitter.

Back to the top |