Thieves Steal Personal Data of 26.5M Vets

[mrbowler]

I realize that this type of stuff happens, but it does question the procedures that are suppose to be followed..Also wanted Veterans(Families) to be aware of this, and be on the look-out.

http://apnews.myway.com//article/200...D8HP8UP01.html

"Thieves took sensitive personal information on 26.5 million U.S. veterans, including Social Security numbers and birth dates, after a Veterans Affairs employee improperly brought the material home, the government said Monday."

"The information involved mainly those veterans who served and have been discharged since 1975, said VA Secretary Jim Nicholson. Data of veterans discharged before 1975 who submitted claims to the agency may have been included."

"Nicholson said there was no evidence the thieves had used the data for identity theft, and an investigation was continuing."

[katlnhats]

I heard about this on the news - isn't it terrible!

Kat

[mrbowler]

Just a Follow-up:

VA gets stolen laptop back:

http://news.com.com/VA+gets+stolen+l...nt&tag=nl.e433

"A preliminary review of the equipment by computer forensic teams has determined that the database remains intact and has not been accessed since it was stolen," the agencies said in a statement. "A thorough forensic examination is under way, and the results will be shared as soon as possible."

[mrbowler]

Bush Asks for Funds to Protect Vets:
http://www.washingtonpost.com/wp-dyn...062801445.html

[katlnhats]

Originally Posted by mrbowler

Bush Asks for Funds to Protect Vets:
http://www.washingtonpost.com/wp-dyn...062801445.html

Interesting. IF, as they claim; the computer wasn't accessed, then why do they need the funds to cover stolen identitys? Let's see..if the computer wasn't accessed, there's no need of the funds as there would be nothing stolen. If funds are needed for Vets, then obviously, the computer was accessed. Didn't even need a hacker as the computer wasn't password protected! How dumb is that?

Kat

[mrbowler]

Originally Posted by katlnhats

Interesting. IF, as they claim; the computer wasn't accessed, then why do they need the funds to cover stolen identitys? Let's see..if the computer wasn't accessed, there's no need of the funds as there would be nothing stolen. If funds are needed for Vets, then obviously, the computer was accessed. Didn't even need a hacker as the computer wasn't password protected! How dumb is that?

Kat

Yep-I was thinking the same thing, but then I said "ok" it is to pay for services to help monitor credit(etc). So basically it's double talk-nothing was stolen, but just in case.

Read this article about how the funds needed to pay for this will come from:
http://www.nytimes.com/2006/06/29/wa...on/29vets.html

Two Senate Democrats on Wednesday criticized a White House plan to cut money intended for food stamps, student loans and farmers to pay for credit monitoring for veterans whose personal and financial data was stolen last month.

"The Bush-Cheney administration has no qualms about coming up here and twisting our arms for funding for Iraq, but when it comes to needs here at home for veterans and other ordinary Americans, it's rob Peter to pay Paul," said Senator Patrick J. Leahy, Democrat of Vermont.

Senator Patty Murray, Democrat of Washington, said, "It's outrageous to first expose millions of Americans to credit fraud and identity theft, and then try to cut food stamps, student loans and youth programs to pay for it."

"This is about taking responsibility when you mess up," Ms. Murray added. "That's something even little kids understand."

Personal data on about 17.5 million veterans, including their birthdates and Social Security numbers, was stolen last month when a burglar took a laptop containing the information from the home of an analyst for the Department of Veterans Affairs. The analyst was not authorized to take the data home but had been doing so for several years.

The Veterans Affairs Department offered to pay for a year of free credit monitoring for the veterans, which it said would cost about $160.5 million. Last week, the department said it would cover most of that cost by taking money from accounts that pay health and other benefits for veterans.

The department withdrew that idea after Democrats protested. In a letter on Wednesday, Rob Portman, director of the White House Office of Management, recommended paying for the monitoring by taking about $130 million from a food stamp employment and training program, a farmers' assistance program, student loans and a program for young people released from prison.

Senator Murray said, "This administration doesn't get it."

Mr. Leahy called the theft and the response to it "the most amazing incompetence" he had seen in 30 years in Congress.

The White House has said it did not want to raise new money to pay for the program, but rather to take money from other areas of the White House budget.

Ms. Murray said the problem was "a new disaster" and "deserves new money." She added, "This is truly an emergency."

The data theft has provoked outrage among veterans' groups; several have joined a class-action lawsuit over the theft. Ms. Murray warned that the credit monitoring will alert veterans only if someone tries to use their stolen information.

The costs of dealing with the theft will rise, she said, if veterans end up being the victims of credit fraud.

BTW-I saw a brief item about this I believe on C-Span, and they asked the person if there were any other security problems, and the guy kind of shrugged and said yes it is 8 pages long....I feel much better.
I'll try to hunt down video/interview and post it...it was a eye opener

[mrbowler]

Ok-I located on C-Span, but I'm not sure what time in segment.

http://www.c-span.org/


Hearings on Veterans Affairs Data Theft with Sec. James Nicholson:

6/29

[TTMommy]

Why in the heck was an employee allowed to take HOME with him sensitive personal data on millions of vets and members of the military?!?!? (I guess it's even more shocking that the privacy of our national protectors ran the risk of being violated, but, in my opinion, NOBODY should be walking around with that kind of information on anybody!)

It makes me wonder who, at various companies, has access to information that I've provided. For example, Cingular wireless required a copy of my driver's license (they may not anymore, but they did a few years ago) in order to get a cell phone. My SS# is on my license. (Next renewal, I'll have it taken off since it's not mandatory, but we didn't used to have to be so paranoid about these things!) What measures does Cingular have in effect to protect that information? Does just my local store have a hard copy of my DL on file, or did the data get entered into a computer? Who has access? What screening do they do when they hire? Seriously, it's almost as if there should be security clearances or something, as is necessary and appropriate for federal employees who handle sensitive government information!

[mrbowler]

Originally Posted by TTMommy

Why in the heck was an employee allowed to take HOME with him sensitive personal data on millions of vets and members of the military?!?!? (I guess it's even more shocking that the privacy of our national protectors ran the risk of being violated, but, in my opinion, NOBODY should be walking around with that kind of information on anybody!)

It makes me wonder who, at various companies, has access to information that I've provided. For example, Cingular wireless required a copy of my driver's license (they may not anymore, but they did a few years ago) in order to get a cell phone. My SS# is on my license. (Next renewal, I'll have it taken off since it's not mandatory, but we didn't used to have to be so paranoid about these things!) What measures does Cingular have in effect to protect that information? Does just my local store have a hard copy of my DL on file, or did the data get entered into a computer? Who has access? What screening do they do when they hire? Seriously, it's almost as if there should be security clearances or something, as is necessary and appropriate for federal employees who handle sensitive government information!

I didn't listen to entire video, but I can tell you that top officials were totally clueless or avoided certain questions regarding your question of why a employee would be allowed to carry sensistive information home-BTW I believe it was for 3 years...it appears that in the future encryption technology will be used. The data includes personal information, medical, social security numbers for veterans 1969 and later, before that time social security numbers were not used to identify. This breach is just one of the many that have either been hushed or not disclosed for numerous reasons-this includes computer tape missing from Region 22 in Indianapolis which I believe was 16,500 records(vets)..So far no arrests have been made...If you have a minute go to approx 3:07 and listen for a couple minutes it will talk briefly about other incidents

[katlnhats]

This is outrageous! Not only taking home sensitive material, but risking the very peoples private information who fought for our country. As to paying the cost, rather than taking it out of the places where it is desperately needed and also have already been cut more than once, why don't they do what they usually do and just take it out of the General Fund. Just stick another IOU in there!
I'm still floored that the computer wasn't password protected.

I remember an old article as it made an impression on me, back when we were involved in Desert Storm. A Higher-up's computer was hacked into, know what his password was? //storm// A child could figure that one out!
Kat

[katlnhats]

Originally Posted by TTMommy

It makes me wonder who, at various companies, has access to information that I've provided. For example, Cingular wireless required a copy of my driver's license (they may not anymore, but they did a few years ago) in order to get a cell phone. My SS# is on my license. (Next renewal, I'll have it taken off since it's not mandatory, but we didn't used to have to be so paranoid about these things!) What measures does Cingular have in effect to protect that information? Does just my local store have a hard copy of my DL on file, or did the data get entered into a computer? Who has access? What screening do they do when they hire? Seriously, it's almost as if there should be security clearances or something, as is necessary and appropriate for federal employees who handle sensitive government information!

One of the sad things is that in some states, one of them being Massachusetts, your drivers license number is "always" your social security number - that's just the way they've been doing them for years. Connecticut doesn't, so my license number is just a number. But, as to who has access when you're asked to provide your license to a company? Pretty much anyone, as most of the companys SELL their customers information to other companys - I "always" ask if they sell info - and if they don't, they will be able to provide this in writing. If they do, I want nothing to do with their product. Just trying to keep myself and family a little safer.

Kat

[mrbowler]

Well it appears everything is ok...


Free credit monitoring for vets withdrawn:

http://www.kansascity.com/mld/kansas...s/15065529.htm

Free credit monitoring for veterans whose personal information was stolen has been withdrawn, the Bush administration said Tuesday, because the laptop containing their data has been recovered.

In a letter to House Speaker Dennis Hastert, White House budget director Rob Portman said he was canceling his office's request last month for $160.5 million in additional funding for the Department of Veterans Affairs to provide one year of free monitoring to millions of veterans and active-duty troops.

He noted that the FBI had determined with a "high degree of confidence" that information stored on the stolen laptop and external drive were not accessed or compromised.

"On the basis of the FBI's analysis, the administration has concluded that credit monitoring services and the associated funding will no longer be necessary," Portman wrote.

The announcement came as the House Veterans Affairs Committee was considering legislation to provide credit protection and strengthen information security following the May 3 theft of 26.5 million veterans' and active-duty troops' names, birth dates and Social Security numbers at a VA data analyst's home.

Veterans groups have said they should still receive the free monitoring following the government's worst information security breach, noting there was no certainty that the information had not been compromised.

They also have criticized the VA for the theft, which came after years of warnings by auditors that information security was lax, and say that other breaches are likely to happen. In a blistering report last week, Veterans Affairs Inspector General George Opfer faulted both the VA data analyst and his supervisors for poor judgment and said dramatic reform was needed.

VA spokesman Matt Burns said Tuesday that although credit monitoring won't be offered, the department planned to hire a company to provide data breach analysis to detect potential patterns of misuse of veterans' information.

He said the analysis will be paid for out of current VA funds that will not result in a "diminution in the quality of health care."

"While the potential for misuse of this data is considered highly unlikely by FBI and law enforcement, data breach analysis will provide additional assurances," Burns said.

The laptop and external drive were recovered June 28 after an informant, responding to a $50,000 reward offer, turned in the equipment to U.S. Park Police. Authorities have said he was not a suspect and no arrests have been made.

[katlnhats]

IMO, the Veterans ought not to wait and call their credit card companys, explain the situation and have new cards sent with a different number. It's done all the time if you should lose your card.
Contact their local SSS office and explain the situation - ask what can be done.
And throw the man in jail for what he did to these people by making their information available to anyone who wanted it.
Kat

[mrbowler]

Just a followup

Teens arrested in VA laptop theft:
http://news.com.com/Teens+arrested+i...ht&tag=nl.e433


But another theft occured

http://reuters.myway.com/article/200...TERANS-DC.html

SAN FRANCISCO (Reuters) - The U.S. Department of Veterans Affairs said on Monday that a desktop computer with personal data on as many as 38,000 U.S. military veterans had disappeared from Unisys Corp., a subcontractor.

Disclosure of the breach comes three days after authorities arrested two teenagers in the theft of a laptop and hard drive containing sensitive data on as many as 26.5 million veterans and military personnel.

The equipment in that case, turned in to authorities on June 28, was stolen May 3 during a burglary of a VA employee's home, authorities said.

In the latest case, Unisys told the VA on August 3 that the computer was missing from the company's offices in Reston, Virginia, the VA said. The VA and Unisys said the data may include names, addresses, Social Security numbers and dates of birth.

The data do not contain personal financial information, Unisys said in a statement, but the VA said it may include patients' insurance carriers and billing information, dates of military service and claims information that may include some medical information.

The VA's inspector general, the U.S. Federal Bureau of Investigation and local law enforcement agencies "are conducting a thorough investigation of this matter," Secretary of Veterans Affairs R. James Nicholson said in a statement.

The agency said it believes the records concern about 5,000 patients treated at the VA medical center in Philadelphia and about 11,000 seen at a VA facility in Pittsburgh over the past four years, as well as about 2,000 deceased veterans.

The agency said it is also investigating whether the computer contained information on about another 20,000 people who were treated at the Pittsburgh medical center.

Unisys said it had launched a "comprehensive search and investigation" and was working with the VA and law enforcement agencies investigating the incident.

[katlnhats]

Uh oh, and some of the best hackers "are" teens! How bout that!

Kat