Nationwide Building Society lost papers in the road
Technorati Tag: Security Breach
Date Reported:
10/24/07
Organization:
Nationwide Building Society
Contractor/Consultant/Branch:
Torquay (UK) Branch
Victims:
Nationwide account holders
Number Affected:
"hundreds"
Types of Data:
Account number, date of birth, National Insurance number*, name and address.
*A National Insurance number is roughly equivalent to a U.K. version of an American Social Security number.
Breach Description:
A Teignmouth couple discovered a box containing hundreds of confidential and personal records lying in the middle of a Teignmouth road. The box was reportedly lost by a Nationwide Building Society bank branch located in Torquay. It is unclear how the box got there or by whom.
Reference URL:
South Devon Herald Express Story
Report Credit:
Keith and Lesley Foote (citizens who found the box and reported it)
South Devon Herald Express
Response:
From the online resource cited above:
"Account numbers, dates of birth, national insurance numbers and names and addresses of hundreds of Nationwide account holders were in the large plastic blue box.The box was found on the A380 by Teignmouth Golf Course by Keith and Lesley Foote from Teignmouth who were travelling back from Exeter Airport at about 5.30am on Monday. They swerved to avoid an obstruction in their path."
[Comfyllama] This implies that the box may have fallen off the back of a truck, maybe?
"Keith, a former police officer, got out of the car and noticed the box had tape around it and it belonged to Nationwide. They took it home and opened it only to discover it was full of personal customer account details for the Torquay branch."
Lesley said: "There were names, addresses, dates of birth, national insurance numbers - everything you would need to steal someone's identity."
"The incident comes after alarming new research published last week showed 79 per cent of people are still being careless with personal details and according to a Home Office study, the cost of identity theft in the UK is £1.7bn, with over 67,000 victims last year alone."
[Comfyllama] 1.7 billion pounds = ~3.4 billion US dollars. That is $3,400,000,000! Even with all of the press and efforts on the part of information security people to inform users, 79% are still careless. These 79% are the same people who make decisions in organizations to not adequately secure data at some of the organizations that the other 21% do business with.
"But Lesley said when they called the police: "They did not seem interested and didn't take a report. My husband even said to them it could be from the proceeds of a crime."
[Comfyllama] Wouldn't even take a report! This news is very alarming to me. Do you think these police are part of the 79% or the 21%?
"We phoned Nationwide as soon as it opened and were told the manager would ring us back at 10am. It was more than 24 hours later before anyone phoned us back about it."
[Comfyllama] Even the bank itself doesn't seem to think that this is important enough to warrant an immediate response. If I were a Nationwide customer, I would seriously consider taking my business elsewhere.
"Lesley said the manager of the bank called back at around 11am yesterday morning and said they would send a courier round to collect the box. She said: "I told her we would not give the box to a third party so eventually she came to collect it in person."
[Comfyllama] Wow! Kudos for Lesley, and "what the he** are you thinking?" to Nationwide.
"The Torquay branch declined to comment on the incident, but a spokeswoman for Nationwide said: "We can confirm an incident took place at our Torquay Branch, however we are unable to comment any further."
"We are working with the local police to assist them with their enquiries and would suggest that you contact them directly for any further information."
[Comfyllama] Hah! The same police that refused to take a report in the first place?
"Police could find no record of the incident."
[Comfyllama] You think?
Public Reactions:
"If we had had any criminal intentions we could have gone to town by now. It's more than appalling. My father has an account with them and he is furious." - Lesley Foote
"Perhaps the senior management at Nationwide need to be conducting a serious review of how they do business. Otherwise face going out of business for good." - Steve Collins
"One rule for the banks, another for us. I suggest anyone who has an account with Nationwide (especially the Torquay branch) vote with their feet and their money and take it eslewhere." - Dee Parsons
"Can the Nationwide not afford a crosscut shredder? They are quite cheap at around £300 for a top of the range for heavy use. Perhaps someone could donate one to this hard up branch?" - Dee Parsons
Commentary:
I am curious as to how this box ended up in the middle of the road. The only thing I can think of is that the box fell off a truck. If the documents were being transported somewhere to be securely destroyed, then how could they have fallen onto the road? Very interesting.
The reaction by the police and Nationwide is very unnerving. I have seen many different security incident reactions in the past, and this one ranks near the top for ineptness. Given this breach, this reaction and what I have read about one of Nationwide's past breaches, I would be taking my money and my business elsewhere!
Past Breaches:
14 February 2007 - FSA fines Nationwide £980,000 for information security lapses
Date Reported:10/24/07
Organization:
Nationwide Building Society
Contractor/Consultant/Branch:
Torquay (UK) Branch
Victims:
Nationwide account holders
Number Affected:
"hundreds"
Types of Data:
Account number, date of birth, National Insurance number*, name and address.
*A National Insurance number is roughly equivalent to a U.K. version of an American Social Security number.
Breach Description:
A Teignmouth couple discovered a box containing hundreds of confidential and personal records lying in the middle of a Teignmouth road. The box was reportedly lost by a Nationwide Building Society bank branch located in Torquay. It is unclear how the box got there or by whom.
Reference URL:
South Devon Herald Express Story
Report Credit:
Keith and Lesley Foote (citizens who found the box and reported it)
South Devon Herald Express
Response:
From the online resource cited above:
"Account numbers, dates of birth, national insurance numbers and names and addresses of hundreds of Nationwide account holders were in the large plastic blue box.The box was found on the A380 by Teignmouth Golf Course by Keith and Lesley Foote from Teignmouth who were travelling back from Exeter Airport at about 5.30am on Monday. They swerved to avoid an obstruction in their path."
[Comfyllama] This implies that the box may have fallen off the back of a truck, maybe?
"Keith, a former police officer, got out of the car and noticed the box had tape around it and it belonged to Nationwide. They took it home and opened it only to discover it was full of personal customer account details for the Torquay branch."
Lesley said: "There were names, addresses, dates of birth, national insurance numbers - everything you would need to steal someone's identity."
"The incident comes after alarming new research published last week showed 79 per cent of people are still being careless with personal details and according to a Home Office study, the cost of identity theft in the UK is £1.7bn, with over 67,000 victims last year alone."
[Comfyllama] 1.7 billion pounds = ~3.4 billion US dollars. That is $3,400,000,000! Even with all of the press and efforts on the part of information security people to inform users, 79% are still careless. These 79% are the same people who make decisions in organizations to not adequately secure data at some of the organizations that the other 21% do business with.
"But Lesley said when they called the police: "They did not seem interested and didn't take a report. My husband even said to them it could be from the proceeds of a crime."
[Comfyllama] Wouldn't even take a report! This news is very alarming to me. Do you think these police are part of the 79% or the 21%?
"We phoned Nationwide as soon as it opened and were told the manager would ring us back at 10am. It was more than 24 hours later before anyone phoned us back about it."
[Comfyllama] Even the bank itself doesn't seem to think that this is important enough to warrant an immediate response. If I were a Nationwide customer, I would seriously consider taking my business elsewhere.
"Lesley said the manager of the bank called back at around 11am yesterday morning and said they would send a courier round to collect the box. She said: "I told her we would not give the box to a third party so eventually she came to collect it in person."
[Comfyllama] Wow! Kudos for Lesley, and "what the he** are you thinking?" to Nationwide.
"The Torquay branch declined to comment on the incident, but a spokeswoman for Nationwide said: "We can confirm an incident took place at our Torquay Branch, however we are unable to comment any further."
"We are working with the local police to assist them with their enquiries and would suggest that you contact them directly for any further information."
[Comfyllama] Hah! The same police that refused to take a report in the first place?
"Police could find no record of the incident."
[Comfyllama] You think?
Public Reactions:
"If we had had any criminal intentions we could have gone to town by now. It's more than appalling. My father has an account with them and he is furious." - Lesley Foote
"Perhaps the senior management at Nationwide need to be conducting a serious review of how they do business. Otherwise face going out of business for good." - Steve Collins
"One rule for the banks, another for us. I suggest anyone who has an account with Nationwide (especially the Torquay branch) vote with their feet and their money and take it eslewhere." - Dee Parsons
"Can the Nationwide not afford a crosscut shredder? They are quite cheap at around £300 for a top of the range for heavy use. Perhaps someone could donate one to this hard up branch?" - Dee Parsons
Commentary:
I am curious as to how this box ended up in the middle of the road. The only thing I can think of is that the box fell off a truck. If the documents were being transported somewhere to be securely destroyed, then how could they have fallen onto the road? Very interesting.
The reaction by the police and Nationwide is very unnerving. I have seen many different security incident reactions in the past, and this one ranks near the top for ineptness. Given this breach, this reaction and what I have read about one of Nationwide's past breaches, I would be taking my money and my business elsewhere!
Past Breaches:
14 February 2007 - FSA fines Nationwide £980,000 for information security lapses
Posted by Evan Francen at 10/25/2007 3:09 PM 
Categories: Poor Business Practice, Nationwide Building Society
Categories: Poor Business Practice, Nationwide Building Society
Posts Atom 1.0
Sometimes the police plays dumb. Maybe because they have no idea who it was and how they can catch the thief.
Reply to this
You lot are stupid, firstly, it is a building society not a bank i.e. there is no such thing as a building society bank, neither does nationwide have bank branches. Secondly, if it had tape round it and you had not criminal intenions, why did you open it? Thirdly, Nationwide will no go out of business for a mistake that would not have resulted in identify fraud as the systems are in place to stop it. Unless they had photographic ID and other data that BUILDING SOCIETIES dont hold, it wont happen. Morons!
Reply to this