The Army National Guard is investigating why a contractor had data including Social Security numbers for 131,000 current and former soldiers on an unsecured personal laptop that was stolen, a spokesman said Thursday.
The Guard was sending letters this week warning those affected to protect themselves from identity theft after the July 27 theft of the laptop belonging to a contract employee, said Randy Noller, spokesman for the National Guard Bureau in Arlington, Va.
He would not release details, including the contractor involved and where it happened, but said police were investigating. The stolen laptop contains names, addresses, Social Security numbers and payment data for those enrolled in the Army National Guard Bonus and Incentives Program.
The Guard had no indication any data has been compromised but affected soldiers, generally those who received enlistment and retention bonuses in recent years, should take precautionary steps such as putting fraud alerts on their credit, Noller said.
He did not know how many of the 131,000 affected are on active duty. Those who are deployed and believe identity theft has occurred are being told to contact the nearest Judge Advocate Office for help.
The Guard is also working with its state affiliates to notify soldiers. In Wisconsin, about 1,700 soldiers were affected, including 800 who are on active duty in Iraq and Afghanistan, said a Wisconsin National Guard spokeswoman, Maj. Jackie Guthrie.
Noller said the Guard’s internal investigation is looking into what security policies were breached in the contractor’s handling of the data, which should not have been on an unsecured private laptop.
“We know simply by virtue of being on a personal laptop there were some security protocols violated. Exactly which ones, how and why is yet to be determined,” he said.
He stressed that “no malice was involved.”
“The guy was doing his job, trying to do it well and didn’t do the right thing,” Noller said.
He said the contractor was cooperating with the Guard’s investigation. A Web site and toll free hotline, 1-877-481-4957, has been set up to handle inquiries.
Computer security expert Larry Ponemon of the Ponemon Institute, a think tank in Traverse City, Mich., said employees should never have that much data on their personal laptops. In a study for Dell Inc., his group estimated last year that up to 600,000 laptops were lost annually at airports alone.
“To physically carry 131,000 records and use your laptop as a way of manipulating that information, there is never an excuse,” he said. “There is no reason that would be an acceptable security posture for any company. That’s definitely an indication of bad security.”
This information was reportedly made available online as the result of several initiatives. From what the report indicates, at least 250,000 bank / credit accounts were hacked into. Other information was the result of phishing, a process that dupes individuals to give over their details (such as log in details or credit card details). The information was intercepted over a four-year period by a British company, 
Posts
