How it happened
Outsiders accessed credit card information that was retained
and stored on its point-of-sale software.
Company's response
HSBC Holdings sent letters to credit card customers warning
them that their information may have been stolen and that
the cards should be replaced.
Date
April 13, 2005
University
Tufts University, Boston
No. of accounts
106,000
An alumni database containing personal information.
How it happened
An outside security breach on a third-party server that the
university was using for fundraising.
Univerisity's response
Sent letters to alumni recommending that they notify their
bank and ask credit bureaus to issue fraud alerts and check
for any unusual activity in their names; set up a toll-free
support line to assist individuals whose information may have
been compromised.
Date
March 28, 2005
University
University of California, Berkeley
No. of accounts
98,369
Individuals' personal information who applied
to or attended UC-Berkeley's graduate school between 1976
and 2004; data included names, birth dates, addresses and
Social Security numbers.
How it happened
Outside hacker planted a program that would enable him to
use the computer to launch attacks on other machines; had
access to personal information.
College's response
Sent letters to alumni urging them to take precautions to
protect their identities and financial accounts; instructed
to contact their banks and warn them that their Social Security
numbers may have been stolen; suggested obtaining copies of
credit reports to check for unusual activity and to put a
''fraud alert" on their credit reports.
Date
March 9, 2005
Company
Lexis-Nexis
(broker of legal and business data)
No. of accounts
310,000
Consumers' names, addresses, Social Security
numbers and driver's license numbers
How it happened
Fraud artists assumed the identities and used the passwords
of legitimate customers to download customer data.
Company's response
Sent notification to all individuals concerned; providing
ongoing credit monitoring and practical support to ensure
that any identity theft is quickly detected and addressed.
How it happened
Computer hackers accessed customer data from 111 DSW stores
between November and February.
Company's response
DSW has not contacted all the customers as it doesn't keep
detailed information on all customers' addresses; contacted
credit card companies -- Visa, MasterCard, American Express
and Discover -- and banks that issue them to notify customers;
encouraged customers to check their credit card statements
and report any irregularities.
Date
Feb. 25, 2005
Company
Bank of America (bank and credit card company)
No. of accounts
1.2 million
Federal employees' customer and account information
with the U.S. government's SmartPay charge card program
How it happened
Computer data tapes were lost in transit by a commercial airline
from a bank facility to a data-storage center.
Company's response
Cardholder accounts included on the data tapes will be monitored
by Bank of America; will contact government cardholders if
any unusual activity is detected.
Date
Feb. 15, 2005
Company
ChoicePoint Inc. (credit and personal information vendor)
No. of accounts
145,000
(750 cases of identity theft tied directly
to the incident.)
Personal data, including names, addresses,
Social Security numbers and credit reports
How it happened
ChoicePoint sold personal information to criminals who had
set up 50 fraudulent accounts by posing as businesses that
needed to run background checks on potential customers. Operated
undetected for more than a year.
Company's response
Sent notifications to consumers whose information was given
to fraudsters; offering opportunity to receive a free, one-year
credit monitoring service from Experian; one free report containing
information from all three national credit reporting companies;
arranged for a single point of contact, through Experian,
to allow consumers to place security alerts on their credit
reports at all three national credit reporting companies.
