Certegy breach worse than reported
The number of consumer records sold to a data broker by a former Certegy Check Services database administrator is actually 8.5 million, about 6 million more than originally reported.
In a filing with the U.S. Securities and Exchange Commission, Fidelity National Information Services, the parent of St. Petersburg, Fla.-based Certegy, reported some of the stolen records only contained names, addresses, telephone numbers and birth dates.
But, about 5.7 million contained checking account numbers and 1.5 million included credit card numbers, according to last week's filing. And the company conceded that more affected records may be identified as the investigation continues.
The former employee, whom Certegy has filed a civil lawsuit against, sold the records to a number of direct marketing firms, but so far, none of the data has been used fraudulently.
"As a result of this apparent theft, the consumers affected received marketing solicitations from the companies that bought the data," Renz Nichols, Certegy president, said in a July 3 statement, which had then estimated the number of stolen records at 2.3 million.
The company continues to warn users on its home page that they must be wary of solicitations from people claiming to be Certegy employees who seek their personal information.
"Please be advised that Certegy’s call center is NOT making any outbound calls to consumers," the statement said. "In fact, the call center staff does not have access to individual consumer information. [Instead] they are available to help those impacted understand what steps can be taken to safeguard their information."
Adam Bosnian, vice president of products and strategies at identity and access management provider Cyber-Ark Software, told SCMagazine.com today that organizations often blindly trust their database administrators (DBAs).
"Organizations need to be aware that these insider incidents are often done by the people with privileged access," he said, adding that DBAs often do their jobs with little or no scrutiny.
Instead businesses must implement monitoring tools and protocols for approving database changes, he said.
Click here to email reporter Dan Kaplan.