Hollywood Video applications found in a dumpster
Technorati Tag: Security Breach
Date Reported:
10/6/08
Organization:
Hollywood Entertainment Corporation (Hollywood Video)
Contractor/Consultant/Branch:
"store off of Highway 291 in Liberty, Mo."*
*This branch has now been closed
Location:
Liberty, Missouri
Victims:
Job applicants and customers
Number Affected:
Unknown
Types of Data:
"application papers that contained names, phone numbers, Social Security numbers and even credit card information"
Breach Description:
"A man who was looking for cardboard boxes discovered piles of papers and personal information that had been left behind" in a dumpster outside of a recently closed Liberty Missouri Hollywood Video store.
Reference URL:
KCTV Channel 5 News
Report Credit:
KCTV Channel 5 News
Response:
From the online source cited above:
The Hollywood Video store off of Highway 291 in Liberty, Mo. is now closed, but what was left in the trash has some alarmed.
A man who was looking for cardboard boxes discovered piles of papers and personal information that had been left behind in the Dumpster [sic] outside the store.
[Evan] How many times have we read about a business closing its doors and being completely careless with the information they collected while they were still in business? If we read about these stories, I can guarantee you that the bad guys/gals do too. Dumpster diving has never been more lucrative.
The former manager of the store, Thomas Sharp, went to the store to try and recover some of the documents.
"I'm trying to recover what may have some important information on it," Sharp said. "It was an accident."
Sharp said a volunteer church group helped clean up the store and accidentally dumped application papers that contained names, phone numbers, Social Security numbers and even credit card information.
[Evan] Oh no he didn't! Does this statement in any way blame the volunteer church group for this breach? I hope not. It is/was the responsibility of the store management (store manager and corporate management) to ensure that sensitive information is properly protected. At the very least, sensitive documents should be placed in locked filing cabinets during their useful life, and shredded beyond reconstruction when they are no longer needed.
"I feel bad," Sharp said. "Hate for there be a situation, put any names in jeopardy, or information used against another person. Never want that to happen."
Sharp said he will do what he can to shred or destroy the papers.
Sharp also said employees were notified that their store was closing last Tuesday and only had a few days to clear out -- noting that it is not an excuse for the mishap.
[Evan] Then why mention it?
The corporate office released the following statement:
Commentary:
I am willing to bet that sensitive information was always poorly protected at this particular Hollywood Video store. I am also willing to bet that this Hollywood Video store is not all that different from thousands of other retail operations all across the country. Us information security professionals need to do what we can to get the word out.
Past Breaches:
Unknown
Date Reported:10/6/08
Organization:
Hollywood Entertainment Corporation (Hollywood Video)
Contractor/Consultant/Branch:
"store off of Highway 291 in Liberty, Mo."*
*This branch has now been closed
Location:
Liberty, Missouri
Victims:
Job applicants and customers
Number Affected:
Unknown
Types of Data:
"application papers that contained names, phone numbers, Social Security numbers and even credit card information"
Breach Description:
"A man who was looking for cardboard boxes discovered piles of papers and personal information that had been left behind" in a dumpster outside of a recently closed Liberty Missouri Hollywood Video store.
Reference URL:
KCTV Channel 5 News
Report Credit:
KCTV Channel 5 News
Response:
From the online source cited above:
The Hollywood Video store off of Highway 291 in Liberty, Mo. is now closed, but what was left in the trash has some alarmed.
A man who was looking for cardboard boxes discovered piles of papers and personal information that had been left behind in the Dumpster [sic] outside the store.
[Evan] How many times have we read about a business closing its doors and being completely careless with the information they collected while they were still in business? If we read about these stories, I can guarantee you that the bad guys/gals do too. Dumpster diving has never been more lucrative.
The former manager of the store, Thomas Sharp, went to the store to try and recover some of the documents.
"I'm trying to recover what may have some important information on it," Sharp said. "It was an accident."
Sharp said a volunteer church group helped clean up the store and accidentally dumped application papers that contained names, phone numbers, Social Security numbers and even credit card information.
[Evan] Oh no he didn't! Does this statement in any way blame the volunteer church group for this breach? I hope not. It is/was the responsibility of the store management (store manager and corporate management) to ensure that sensitive information is properly protected. At the very least, sensitive documents should be placed in locked filing cabinets during their useful life, and shredded beyond reconstruction when they are no longer needed.
"I feel bad," Sharp said. "Hate for there be a situation, put any names in jeopardy, or information used against another person. Never want that to happen."
Sharp said he will do what he can to shred or destroy the papers.
Sharp also said employees were notified that their store was closing last Tuesday and only had a few days to clear out -- noting that it is not an excuse for the mishap.
[Evan] Then why mention it?
The corporate office released the following statement:
"Hollywood Video takes this matter very seriously and has strict policies in place to safeguard the personal information of all customers. Unfortunately, in this instance, it appears that employees tasked with closing the company's store in Liberty, Mo., may not have followed these company policies. The company has an internal investigation under way and is cooperating fully with the appropriate authorities. Any employee who is found to have violated these policies will be disciplined appropriately."
Commentary:
I am willing to bet that sensitive information was always poorly protected at this particular Hollywood Video store. I am also willing to bet that this Hollywood Video store is not all that different from thousands of other retail operations all across the country. Us information security professionals need to do what we can to get the word out.
Past Breaches:
Unknown
Posted by Evan Francen at 10/12/2008 9:57 PM 
Categories: Hollywood Video, Hollywood Entertainment Corp, Insecure Discard
Categories: Hollywood Video, Hollywood Entertainment Corp, Insecure Discard
Posts Atom 1.0
While this is most likely an innocent mistake, it's remarkable how often businesses throw sensitive personal information in the trash.
Reply to this