|
July 28, 2017 - There are numerous ways that we've seen companies create data breaches without the involvement of outside hacker or theft. They've attached customer lists to email messages. They've thrown out highly confidential records without shredding them. They've had employees misplace computer hard drives that contain customer records. But according to the New York Times the latest Wells Fargo data breach is different because not only was it self-inflicted. The data actually should have been spotted because it went through three levels of screening before the company turned it over to a third party.
This particular breach involves a lawsuit between a former employee of the company and a current employee. Attorneys for the former employee subpoenaed information that included some data on the company's customers. That information was to be used in the lawsuit's discovery process.
In the end, the company turned the data over to its outside counsel. And that outside counsel turned it over to the ex-employee's attorney. Unfortunately for Wells Fargo and its customers, the data included the personally identifiable information of an estimated 50,000 customers; including their SSNs, account numbers and balances.
Wells Fargo is blaming its outside attorneys. Those attorneys are blaming the company they hired to screen discovery data. In essence, they have formed a circular firing squad.
In our opinion what is clear from the data breach is that nobody, including Wells Fargo, bothered to look at the data that was being turned over. And the message is also clear to anyone who works with personally identifiable information. It is your responsibility to know what you are turning over to third parties. Every one of the entities that had responsibility for screening the data in this breach has some culpability, but the data belonged to Wells Fargo and they should be ultimately responsible. The data breach couldn't have happened without them.
byJim Malmberg
Note: When posting a comment, please sign-in first if you want a response. If you are not registered, click here. Registration is easy and free.
Follow me on Twitter:
|
Identity Theft 
