From MSNBC, 2/14/05:
http://www.msnbc.msn.com/id/6969799

Database giant gives access to fake firms

ChoicePoint warns more than 30,000 they may be at risk

EXCLUSIVE
By Bob Sullivan
Technology correspondent
MSNBC

Criminals posing as legitimate businesses have accessed critical
personal data stored by ChoicePoint Inc., a firm that maintains
databases of background information on virtually every U.S. citizen,
MSNBC.com has learned.

The incident involves a wide swath of consumer data, including names,
addresses, Social Security numbers, credit reports and other
information.

ChoicePoint aggregates and sells such personal information to
government agencies and private companies.

Last week, the company notified between 30,000 and 35,000 consumers in
California that their personal data may have been accessed by
"unauthorized third parties," according to ChoicePoint spokesman James
Lee.

California law requires firms to disclose such incidents to the
state's consumers when they are discovered.

It is the only state with such a requirement but such data thefts are
rarely limited to a single geographic area.

Lee said law enforcement officials have so far advised the firm that
only Californians need to be notified.

"The only incident that has been confirmed is in California," he said.

ChoicePoint maintains a dossier on virtually every American consumer,
according to Daniel J. Solove, George Washington University professor
and author of "The Digital Person."

The Atlanta-based company says it has 10 billion records on
individuals and businesses, and sells data to 40 percent of the
nation's top 1,000 companies.

It also has contracts with 35 government agencies, including several
law enforcement agencies.

Victims told months after the fact

The incident was discovered in October, when ChoicePoint was contacted
by a law enforcement agency investigating an identity theft crime.

In that incident, suspects had posed as a ChoicePoint client to gain
access to the firm's rich consumer databases.

Subsequent research by ChoicePoint revealed that about 50 fake
companies had been set up and then registered with ChoicePoint to
access consumer data.

California consumers who received warning letters from the firm last
week were "in some way connected to searches" conducted by those fake
accounts, Lee said.

The firm was only given clearance by law enforcement officials to
disclose the incident two weeks ago, Lee said

While the criminals had access to ChoicePoint data, it's not clear
what, if any, information was stolen, said Chuck Jones, another
ChoicePoint spokesman.

The letters were sent as a precaution, he said.

The FBI, Los Angeles County Sheriff's Office, and the U.S. Postal
Inspector's Office are investigating, he said.

Consumer frustrated by notification
The letter urges consumers to check their credit reports for
suspicious activity.

advertisement

"We believe that several individuals, posing as legitimate business
customers, recently committed fraud by claiming to have a lawful
purpose for accessing information about individuals," it reads. "You
should continue to check your credit reports frequently for the next
year."

The two-page letter offers details on how to spot fraud, but no
additional information about the incident, or what information may
have actually been stolen.

"ChoicePoint has apologized for any inconvenience this incident may
cause," said ChoicePoint spokesman Chuck Jones.

"But ChoicePoint has no way of knowing whether anyone's personal
information actually has been accessed," or used to commit identity
theft, he added.

California consumer Elizabeth Rosen, who received the ChoicePoint
letter Friday, was upset that the company only provided sketchy
details about the incident to her.

"They gave a toll free number to call, but when I called, the person
just read from a script ... they said disclosing too many details may
hurt an ongoing investigation," Rosen said.

"I'm not happy about this. I didn't even know who ChoicePoint was."

That reaction is common, according to Solove.

"Even though you might not have heard of ChoicePoint, they've heard of
you. They are playing a role in your people's lives whether they know
it or not," he said.

Privacy consultant Larry Ponemon, who operates the Ponemon Institute,
said he was surprised criminals were able to pose as ChoicePoint
clients.

"What really concerns me is when low-tech methods are used to gain
access, than you really have problems," said.

"Obviously this is very surprising, given that they are in the data
business."

Jones said ChoicePoint had adjusted its procedures to "help protect
against a repeat" of the incident.

_________________________________________________________

From more on personal data giant databases;

Giant transforming itself into a private intelligence service
http://www.msnbc.msn.com/id/6846357/

What are these companies saying about you?
http://www.msnbc.msn.com/id/6678137/

Harry