Another database heist

Lexis Nexis says hackers commandeered one of its databases, gaining access to the personal files of as many as 32,000 people.

Federal and company investigators are looking into the security breach in the Seisint database, which was recently acquired by Lexis Nexis and includes millions of personal files for use by such customers as police and legal professionals.

Seisint also provides data for Matrix, a crime and terrorism database project funded by the U.S. government that has raised civil rights concerns.

[...]

This is the second such infiltration at a large database provider in recent months. Rival database ChoicePoint Inc. said last month that the personal information of 145,000 Americans may have been compromised by thieves posing as small business customers.

In the ChoicePoint scam, at least 750 people were defrauded, authorities say. The incident fueled consumer advocates' calls for federal oversight of the loosely regulated data-brokering business, and legislative hearings are expected.

Both data heists, says CBS News Technology Analyst Larry Magid, involve personal information stored in large commercial databases - whose security is beyond the control of consumers.

"As long as companies continue to warehouse information, consumers are sitting ducks for identity theft. This is not a case of people being careless about their passwords or documents or the security of their PCs," says Magid. "This is wholesale theft of consumer data and there is almost nothing individuals can do to prevent this type of hacking."
  article

No, but we could probably do something about the practice of data collection and storage. That is, if we weren't so busy trying to stop gays from marrying and women from getting abortions.

Lexis Nexis will be notifying the estimated 32,000 affected customers in the coming days. CEO Kurt Sanford says the company will provide them with ongoing credit monitoring "and other support to ensure that any identity theft that may result from these incidents is quickly detected and addressed."

The company will also be tightening its ID and password requirements and administrative procedures.

"The U.S. law enforcement agencies have asked us not to say too much, as they are in the process of trying to track down the people who are responsible," said Reed Elsevier spokeswoman Catherine May.

Actually, calling the ChoicePoint fiasco a data heist is technically incorrect. That company actually "inadvertently" sold the information to crooks.

The announcement came after the recent disclosures of other cases involving the loss or theft of consumer data. ChoicePoint, a major data broker, said last month that it had inadvertently sold the records of more than 140,000 individuals to thieves. And Bank of America said recently that backup computer tapes containing information on more than one million of its customers had been lost.
  IHT article

Oh, yeah. We forgot Bank of America. Lost the tapes. Rather careless with such important information, eh?

I can't believe it is all of a sudden just so much easier to steal data that there happen to be three such incidences so close together. Does this happen more frequently than we have been told? Have I just not been paying attention? Or what?

LexisNexis said it had not yet determined how access may have been gained to the files but that it appeared to have involved unauthorized use of the passwords of legitimate subscribers to its databases, rather than a hacker attack.

"Insider" jobs?

The breach at LexisNexis is almost certain to accelerate calls from privacy advocates and state and national officials for greater scrutiny of the companies that buy, store and sell consumer data. The issue was to be taken up Thursday in a hearing before the Senate Banking, Housing and Urban Affairs Committee, and again Tuesday at a similar hearing before the House Energy and Commerce Committee.

[...]

LexisNexis and its parent company in London, the publishing and information services giant Reed Elsevier, said the recent breach involved databases acquired in July through the $775 million purchase of Seisint, a Florida-based compiler of consumer background and asset information.

Seisint has two main products: Accurint, a service for locating people and determining their financial assets; and Securint, a background screening service.

Florida again. ChoicePoint was the data miner of choice to help create Florida's Bush election theft. Same guy (Hank Asher) created these database programs.

In May 2003, Rabbi Joel Levine brought suit in the U.S. District Court for the Southern District of Florida against ChoicePoint for violation of the Driver's Privacy Protection Act (DPPA). (Levine v. ChoicePoint, No. 03-80491.) That law requires that a state obtain express consent from an individual before motor vehicle department records can be sold for direct marketing or other purposes. Levine alleged that ChoicePoint knowingly obtained personal information from the Florida department of motor vehicles for resale to others, in violation of the DPPA. A similar suit was brought against Lexis-Nexis. (Levine v. Reed Elsevier, No. 03-80490). Levine voluntary dismissed both suits, and the cases were closed in 2003.

A similar action was filed on May 29, 2003 titled Brooks, et al v. Auto Data Direct, et al, No. 03-61063. That action alleges violations of the DPPA against ChoicePoint, company's subsidiaries, and a number of other private-sector data sellers, including Experian, Polk, Seisint, Acxiom, and Reed Elsevier.
  Epic article

I wonder why the Rabbi dropped the suits.

Some background on Hank Asher and Seisint from Greg Palast:

My good friend Hank Asher is back with another alias this one is Seisint. For those who read my book or Michael Moore's back, database technologies, his old company is the organization that came up with the list now up to 97,000 names of supposed felons in Florida who are scrubbed off the voter roles before the presidential election, it turns out almost every name on that list was an innocent person, they were named as felons by this company, by Hank Asher's company, named at felons, they weren't felons, they lost their vote and, surprise, most of them were African Americans. And that fixed our election.

Hank is back. Now Hank was thrown off the board of the company he founded by the U.S. Drug enforcement agency. Because of his connections to Bahamian drug dealers, they said if that guy is on we don't want anything to do with him because of his connections. So here he is back with a different costume on. And up to the same tricks, first he is such a wonderful guy, of course first thing he's doing is jumping on the September 11th war on terror bandwagon see if he can suck a few bucks out that have one, too. So the first thing he's doing is giving away supposedly free software that's exactly what his last company did with Database Technologies to strub the voter roles.

I'll give you a little software, and what this does is it gives the law enforcement agencies their first free information heroin fix.

So they are now spending millions of dollars in staff time and equipment to run this software and then he's got them.

There's no where else to go. Note that there is no bidding for this. Of all the people on this planet, to put in charge of minding these very sensitive databases about who is a terrorist and who isn't, I mean Hank Asher would be at the bottom of my list.

...but hey, do what you want...you will anyway...