Complain about a product or service

Thieves Steal AT&T Laptop with Employee Data

Unencrypted computer contains personal information on management, staff

By Martin H. Bosworth
ConsumerAffairs.Com

June 9, 2008

The laptop, which had no encryption or security protection beyond a password lock, contained names, Social Security numbers, and salary information for an undisclosed number of workers.

Employees were notified of the theft on May 22, seven days after the theft, according to privacy watchdog PogoWasRight.org, which first reported the story. In a letter to employees, AT&T said that, "The measures and precautions we put in place to protect the security of company-owned property and our employees' personal information were not followed."

AT&T said that the responsible employee "has been disciplined."

"We believe that this was a random property crime and we have no reason to believe this personal information has been compromised," the company said. AT&T offered free credit monitoring from Equifax and has set up a toll-free number for employees to inquire if they were affected.

Disgruntled

AT&T employees were disgruntled at the thought of their personal information being at risk due to lack of basic computer security procedures. "It is pathetic that the largest telecom company in the world -- with more than 100 million customers -- doesn't encrypt basic personal information," one manager told NetworkWorld.Com.

Institutions from Boeing to Kaiser Permanente have suffered embarrassing data breaches when laptops belonging to the companies were stolen, all with valuable personal information such as names, Social Security numbers, payroll records, and addresses on them.

The granddaddy of all laptop-based data breaches was the theft of a laptop containing records on 26 million veterans from the home of an analyst for the Veterans' Administration in May 2006. The laptop was eventually recovered, and Maryland police charged two teenagers and an underage accomplice with the crime. The FBI claimed that the data on the laptop had not been accessed or misused.

Laptop theft or loss is one of the most common sources of data breaches, due to the continued practice of employees taking personal information away from the office, and companies not practicing comprehensive security solutions, such as encryption of the laptop hard disk or utilizing a virtual private network (VPN) to access information in other locations.

In addition to using whole disk encryption, a host of businesses now offer remote tracking and file deletion for stolen laptops, but only if they access the Internet. The best way to ensure personal, corporate, or government data is not exposed to theft is to not keep it on a mobile device, or to use full-disk encryption if there is no other option.

Report Your Experience
If you've had a bad experience -- or a good one -- with a consumer product or service, we'd like to hear about it. All complaints are reviewed by class action attorneys and are considered for publication on our site. Knowledge is power! Help spread the word. File your consumer report now.

Back to the top |