Houston law firm threw confidential client information in the trash
Technorati Tag: Security Breach
Date Reported:
7/15/08
UPDATE 7/18/08:
This breach has now gained the attention of Texas Attorney General Gregg Abbott, Source: KHOU-TV (props to PogoWasRight)
Organization:
Weber Law Firm
Contractor/Consultant/Branch:
"his wife"
Victims:
Clients
Number Affected:
"hundreds"
Types of Data:
"personal financial records, documents with Social Security numbers, people's medical files and more"
Breach Description:
"HOUSTON -- Harris County Sheriff's deputies uncovered hundreds of people's personal financial files that had been discarded in a dumpster in northwest Houston on Monday."
Reference URL:
KHOU-TV News (original)
KHOU-TV News (follow-up)
Report Credit:
Jeremy Desel, KHOU-TV
Response:
From the online sources cited above:
Harris County Sheriff's deputies uncovered hundreds of people's personal financial files that had been discarded in a dumpster in northwest Houston on Monday.
The records were mostly bankruptcy case files from a Houston attorney's office that found their way into a dumpster belonging to a Houston day care.
[Evan] There is little doubt about the sensitivity of the information found in a person's bankruptcy files. Don't you think that an attorney should know better?
The discovery came in a trash bin in the 9100 block of Jones Road, with box after box of records including personal financial records, documents with Social Security numbers, people's medical files and more.
When the sheriff's office first arrived, the responding deputies had no idea what to do with the records.
So, they called the law office from where the records had come from. 11 News called the law offices of William Weber as well.
[Evan] Mr. Weber's bio is pretty extensive.
Weber, who eventually arrived to pick up the discarded records, told both 11 News and the sheriff's office that it was "no big deal"
[Evan] Obviously, this answer probably doesn't go over very well. In hindsight, I am guessing that Mr. Weber wishes he could take these words back.
Still, at the insistence of the sheriff's office, Weber did arrive to pick the boxes up.
Weber had a different answer for 11 News when he showed up to retrieve the 32 boxes.
"It's a mistake," he said. "We regret it. We regret it. They weren't intended to be put here. I didn't put them here. It was a misunderstanding between me and my wife."
[Evan] Ugh. Blaming the wife would not be a good idea in my house, even if it were her fault.
He added it was a one-time problem.
But he also said his firm does not have a policy for disposing of sensitive documents.
"No, I do not. I don't think there is a formal disposal policy. Legally," he answered.
Don't tell that to Radio Shack or Select Medical Corporation. Both settled lawsuits with the Texas Attorney General's Office this week for violating the Texas ID Theft Law that was passed in 2005.
It requires businesses to destroy any documents that contain sensitive information. Select Medical dumped 4,000 documents in its own dumpster, but did not destroy them first.
Both companies settled this week with the state for hundreds of thousands of dollars in fines.
[Evan] Don't forget about EZMONEY, L.P. and EZPAWN L.P. They agreed to pay $660,000 to the Texas Attorney General. Don't mess with Texas!
However, it's not just a civil law question. It is also an ethics question.
"If a customer of Radio Shack had an interest in privacy and an interest to have their identity protected (and) not just tossed to the wind, I can assure you that a medical provider or a lawyer has a higher duty," said 11 News legal expert Gerald Treece.
The sheriff's office is looking into the possibility laws were broken by throwing away the records in that dumpster, but were unsure if anything illegal happened.
As a matter of fact, there's a good possibility no laws were broken.
[Evan] Not criminal. This case may be ripe for a civil proceeding, however.
Weber spent several minutes loading the boxes into his car, but he also spent a lot of time avoiding the 11 News cameras as he picked up the discarded records.
Eventually, he left the scene, leaving a few boxes behind when he was confronted by 11 News cameras.
In his rush to get away, a box was left on the trunk lid of his vehicle and some of the papers inside flew out as he sped off.
[Evan] Embarrassed?
Weber told 11 News that all the documents were shredded on Wednesday morning.
[Evan] Any thought given to notifying the affected individuals? If not, it is probably too late now.
Weber also said he has talked with an attorney at the attorney general's office and told them he would cooperate fully.
11 News also spoke with one of the clients whose file was found in the dumpster on Monday. She said she's angry and feels betrayed.
Commentary:
We have read about organizations dumping sensitive confidential information in dumpsters before, but this is the first time I have read about a lawyer being responsible (or his wife). Mistakes do happen, but I question how much of a mistake this actually was due to Mr. Weber's initial "no big deal" reaction.
Past Breaches:
Unknown
Date Reported:7/15/08
UPDATE 7/18/08:
This breach has now gained the attention of Texas Attorney General Gregg Abbott, Source: KHOU-TV (props to PogoWasRight)
Organization:
Weber Law Firm
Contractor/Consultant/Branch:
"his wife"
Victims:
Clients
Number Affected:
"hundreds"
Types of Data:
"personal financial records, documents with Social Security numbers, people's medical files and more"
Breach Description:
"HOUSTON -- Harris County Sheriff's deputies uncovered hundreds of people's personal financial files that had been discarded in a dumpster in northwest Houston on Monday."
Reference URL:
KHOU-TV News (original)
KHOU-TV News (follow-up)
Report Credit:
Jeremy Desel, KHOU-TV
Response:
From the online sources cited above:
Harris County Sheriff's deputies uncovered hundreds of people's personal financial files that had been discarded in a dumpster in northwest Houston on Monday.
The records were mostly bankruptcy case files from a Houston attorney's office that found their way into a dumpster belonging to a Houston day care.
[Evan] There is little doubt about the sensitivity of the information found in a person's bankruptcy files. Don't you think that an attorney should know better?
The discovery came in a trash bin in the 9100 block of Jones Road, with box after box of records including personal financial records, documents with Social Security numbers, people's medical files and more.
When the sheriff's office first arrived, the responding deputies had no idea what to do with the records.
So, they called the law office from where the records had come from. 11 News called the law offices of William Weber as well.
[Evan] Mr. Weber's bio is pretty extensive.
Weber, who eventually arrived to pick up the discarded records, told both 11 News and the sheriff's office that it was "no big deal"
[Evan] Obviously, this answer probably doesn't go over very well. In hindsight, I am guessing that Mr. Weber wishes he could take these words back.
Still, at the insistence of the sheriff's office, Weber did arrive to pick the boxes up.
Weber had a different answer for 11 News when he showed up to retrieve the 32 boxes.
"It's a mistake," he said. "We regret it. We regret it. They weren't intended to be put here. I didn't put them here. It was a misunderstanding between me and my wife."
[Evan] Ugh. Blaming the wife would not be a good idea in my house, even if it were her fault.
He added it was a one-time problem.
But he also said his firm does not have a policy for disposing of sensitive documents.
"No, I do not. I don't think there is a formal disposal policy. Legally," he answered.
Don't tell that to Radio Shack or Select Medical Corporation. Both settled lawsuits with the Texas Attorney General's Office this week for violating the Texas ID Theft Law that was passed in 2005.
It requires businesses to destroy any documents that contain sensitive information. Select Medical dumped 4,000 documents in its own dumpster, but did not destroy them first.
Both companies settled this week with the state for hundreds of thousands of dollars in fines.
[Evan] Don't forget about EZMONEY, L.P. and EZPAWN L.P. They agreed to pay $660,000 to the Texas Attorney General. Don't mess with Texas!
However, it's not just a civil law question. It is also an ethics question.
"If a customer of Radio Shack had an interest in privacy and an interest to have their identity protected (and) not just tossed to the wind, I can assure you that a medical provider or a lawyer has a higher duty," said 11 News legal expert Gerald Treece.
The sheriff's office is looking into the possibility laws were broken by throwing away the records in that dumpster, but were unsure if anything illegal happened.
As a matter of fact, there's a good possibility no laws were broken.
[Evan] Not criminal. This case may be ripe for a civil proceeding, however.
Weber spent several minutes loading the boxes into his car, but he also spent a lot of time avoiding the 11 News cameras as he picked up the discarded records.
Eventually, he left the scene, leaving a few boxes behind when he was confronted by 11 News cameras.
In his rush to get away, a box was left on the trunk lid of his vehicle and some of the papers inside flew out as he sped off.
[Evan] Embarrassed?
Weber told 11 News that all the documents were shredded on Wednesday morning.
[Evan] Any thought given to notifying the affected individuals? If not, it is probably too late now.
Weber also said he has talked with an attorney at the attorney general's office and told them he would cooperate fully.
11 News also spoke with one of the clients whose file was found in the dumpster on Monday. She said she's angry and feels betrayed.
Commentary:
We have read about organizations dumping sensitive confidential information in dumpsters before, but this is the first time I have read about a lawyer being responsible (or his wife). Mistakes do happen, but I question how much of a mistake this actually was due to Mr. Weber's initial "no big deal" reaction.
Past Breaches:
Unknown
Posts Atom 1.0
Yep, AG Abbott is now all over this one.
I don't know who Weber has to fear most -- the AG or his wife. ;-)
Reply to this
Attorney General Gregg Abbott does a great job in his effort to protect his constituents. If I lived in Texas, he would have my vote.
Actually, I would fear my wife more. She's a Breach Blog reader.
Reply to this
Both Texas and Connecticut AG's seem to be leaders in terms of dealing with these issues.
Of course, a state attorney general can only prosecute or pursue cases if the state legislature has enacted meaningful legislation. For example, Texas was not able to pursue the WellPoint breach, even if it wanted to, because of the way their laws are worded.
While the federal government continues to sit on its hands, states need to give their top law enforcement officers the authority and the tools to protect the public.
Reply to this
Mr. Weber called us after the discovery and had us come out the next morning and destroy the mentioned files. Even if it was an honest mistake, he is in for a HUGE fine.
Reply to this