Certegy breach worse than reported

Share this article:

The number of consumer records sold to a data broker by a former Certegy Check Services database administrator is actually 8.5 million, about 6 million more than originally reported.

In a filing with the U.S. Securities and Exchange Commission, Fidelity National Information Services, the parent of St. Petersburg, Fla.-based Certegy, reported some of the stolen records only contained names, addresses, telephone numbers and birth dates.

But, about 5.7 million contained checking account numbers and 1.5 million included credit card numbers, according to last week's filing. And the company conceded that more affected records may be identified as the investigation continues.

The former employee, whom Certegy has filed a civil lawsuit against, sold the records to a number of direct marketing firms, but so far, none of the data has been used fraudulently.

"As a result of this apparent theft, the consumers affected received marketing solicitations from the companies that bought the data," Renz Nichols, Certegy president, said in a July 3 statement, which had then estimated the number of stolen records at 2.3 million.

The company continues to warn users on its home page that they must be wary of solicitations from people claiming to be Certegy employees who seek their personal information.

"Please be advised that Certegy’s call center is NOT making any outbound calls to consumers," the statement said. "In fact, the call center staff does not have access to individual consumer information. [Instead] they are available to help those impacted understand what steps can be taken to safeguard their information."

Adam Bosnian, vice president of products and strategies at identity and access management provider Cyber-Ark Software, told SCMagazine.com today that organizations often blindly trust their database administrators (DBAs).

"Organizations need to be aware that these insider incidents are often done by the people with privileged access," he said, adding that DBAs often do their jobs with little or no scrutiny.

Instead businesses must implement monitoring tools and protocols for approving database changes, he said.

 

Click here to email reporter Dan Kaplan.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Skills in demand: Communications and messaging experts

Skills in demand: Communications and messaging experts

The demand for infosec-focused communications and messaging pros is growing.

Company news: New execs at Malwarebytes and an acquisition by VMware

The latest mergers and acquisitions and personnel moves, including Malwarebytes, Abacus Group, VMware, Bay Dynamics, vArmour, Secunia, Norse and more.

Bridging the talent gap in health care

Bridging the talent gap in health care

Cybercriminals are primarily after patient data as it really gets them more money.