IBM loses sensitive employee tapes off back of truck

Stan Beer
Wednesday, 16 May 2007 13:31

Your IT - Home IT

The world's largest computer company IBM has serious egg on its face after losing tapes containing sensitive personal data concerning both employees and customers, according to an Associated Press report. Some of the tapes contain unencrypted highly personal details such as social security numbers, dates of birth and addresses of thousands of former employees, which could be used for identity theft. The blunder could expose IBM to potential legal action.

IBM is now reportedly trying to track down the missing computer tapes which literally fell off the back of a truck belonging to a courier assigned to transport them between two IBM offices in New York state.

IBM has admitted that the data on at least some of the tapes lost was not encrypted. It is not clear how and why tapes containing unencrypted sensitive data came to be transported physically by a third party and it may open up the potential for legal action against the computer giant which has more than 350,000 employees.

According to Alan Bell, Asia Pacific marketing director of security firm McAfee, many firms in addition to IBM have lost sensitive data because they have no control or knowledge of what information they have and how it moves throughout the organization.

"In the case of IBM, data fell off the back of truck. There have been many other cases where data has literally fallen off the back of a truck," said Bell.

"IBM has now joined the ranks of (US retail group) TJX which lost the details of 47.5 million customer credit cards. That company now faces multiple class action suits as well as legal action from a number of banks which may cost it tens of millions of dollars."

When asked if using a third party to physically transport and then subsequently losing unencrypted sensitive data concerning employees could have legal ramifications for IBM, Bell declined to comment.

However, he said: "Having access to sensitive data does not mean you own it and it doesn't mean you have the right to move it. A company has an obligation to protect confidential information about employees because it could cost them money if it's lost. Encrypting that information is one technique that can be used.