27,000,000 + Personal Information Records Lost from Stolen Laptops Alone

July 09, 2006

One of my pet peeves, besides confirmation dialogs (YES I am SURE!), is people who store the personal information of others on a laptop. There is no real need for this any longer, Verizon broadband anywhere, VPN/SSL, Bluetooth Internet connected phones, etc.

The total stolen records on this page is 88,000,000+, the total just from laptops being stolen is over 27,000,000.

http://www.schneier.com/blog/archives/2006/07/a_chronology_of.html

“The data breaches noted below have been reported because the personal information compromised includes data elements useful to identity thieves, such as Social Security numbers, account numbers, and driver's license numbers. A few breaches that do NOT expose such sensitive information have been included in order to underscore the variety and frequency of data breaches. However, we have not included the number of records involved in such breaches in the total because we want this compilation to reflect breaches that expose individuals to identity theft as well as breaches that qualify for disclosure under state laws.”

March 11, 2005			Univ. of CA, Berkeley (Berkeley, CA)			Stolen laptop	98,400
April 5, 2005			MCI (Ashburn, VA)			Stolen laptop	16,500
April 15, 2005			CA Dept. of Health Services			Stolen laptop	21,600
April 29, 2005			Oklahoma State Univ.			Missing laptop	37,000
May 4, 2005			CO. Health Dept.			Stolen laptop	1,600
May 7, 2005			Dept. of Justice (Washington, D.C.)			Stolen laptop	80,000
May 27, 2005			Cleveland State Univ. (Cleveland, OH).			Stolen laptop Update 12/24: CSU found the stolen laptop	44,420
June 17, 2005			Kent State Univ.			Stolen laptop	1,400
June 22, 2005			Eastman Kodak			Stolen laptop	5,800
June 29, 2005			Bank of America			Stolen laptop	18,000
June 30, 2005			Ohio State Univ. Med. Ctr.			Stolen laptop	15,000
Aug. 27, 2005			Univ. of Florida, Health Sciences Center/ChartOne			Stolen Laptop	3,851
Aug. 30, 2005			J.P. Morgan, Dallas			Stolen Laptop	Unknown
Sept. 17, 2005			North Fork Bank, NY			Stolen laptop (7/24/05) with mortgage data	9,000
Sept. 23, 2005			Bank of America			Stolen laptop with info of Visa Buxx users (debit cards)	Not disclosed
Nov. 1, 2005			Univ. of Tenn. Medical Center			Stolen laptop	3,800
Nov. 5, 2005			Safeway, Hawaii			Stolen laptop	1,400 in Hawaii, perhaps more elsewhere
Nov. 19, 2005			Boeing			Stolen laptop with HR data incl. SSNs and bank account info.	161,000
Dec. 1, 2005			Firstrust Bank			Stolen laptop	100,000
Dec. 6, 2005			WA Employment Security Dept.			Stolen laptop. Names, SSNs and earnings of former employees.	530
Late Dec.			Ameriprise			Stolen laptop containing names and Social Security numbers and in some cases, Ameriprise account information.	Unknown
2005 [Exact Date Unknown]			Dept. of Veterans Affairs (Washington, D.C.)			A laptop being stored in the trunk of a car was stolen in Minneapolis, Minnesota. 2 people later reported identity fraud problems.	66
Jan. 24, 2006			Univ. of WA Medical Center			Stolen laptops containing names, Social Security numbers, maiden names, birth dates, diagnoses and other personal data.	1,600
Feb. 13, 2006			Ernst & Young (UK)			Laptop stolen from employee's car with customers' personal information including Social Security numbers.	38,000 BP employees in addition to Sun, Cisco and IBM employees.
Feb. 17, 2006			Mount St. Mary's Hospital (1 of 10 hospitals with patient info. stolen) (Lewiston, NY)			Two laptops containing date of birth, address and Social Security numbers of patients was stolen in an armed robbery in the New Jersey.	17,000
Feb. 18, 2006			Univ. of Northern Iowa			Hacking. Laptop computer holding W-2 forms of student employees and faculty was illegally accessed.	6,000
Mar. 1, 2006			Medco Health Solutions (Columbus, OH)			Stolen laptop containing Social Security numbers for State of Ohio employees and their dependents, as well as their birth dates and, in some cases, prescription drug histories.	4,600
Mar. 3, 2006			Metropolitan State College (Denver, CO)			Stolen laptop containing names and Social Security numbers of students who registered for Metropolitan State courses between the 1996 fall semester and the 2005 summer semester.	93,000
Mar. 8, 2006			Verizon Communications (New York, NY)			2 stolen laptops containing employees' personal information including Social Security numbers.	"Significant number"
Mar. 15, 2006		Ernst & Young (UK)			Laptop lost containing the names, dates of birth, genders, family sizes, Social Security numbers and tax identifiers for current and previous IBM, Sun Microsystems, Cisco, Nokia and BP employees exposed.
Mar. 23, 2006	Fidelity Investments (Boston, MA)			Stolen laptop containing names, addresses, birth dates, Social Security numbers and other information of 196,000 Hewlett Packard, Compaq and DEC retirement account customers was stolen.				196,000
Mar. 24, 2006	Vermont State Colleges (VT)			Laptop stolen containing Social Security numbers and payroll data of students, faculty and staff associated with the five-college system from as long ago as 2000.				14,000
April 26, 2006	Aetna -- health insurance records for employees of 2 members, including Omni Hotels and the Dept. of Defense NAF (Hartford, CT)			Laptop containing personal information including names, addresses and Social Security numbers of Dept. of Defense (35,253) and Omni Hotel employees (3,000) was stolen from an Aetna employee's car.				38,000
May 12, 2006	Mercantile Potomac Bank (Gaithersburg, MD)			Laptop containing confidential information about customers, including Social Security numbers and account numbers was stolen when a bank employee removed it from the premises, in violation of the bank's policies. The computer did not contain customer passwords, personal identification numbers (PIN numbers) or account expiration dates.				48,000
May 22, 2006	Dept. of Veterans Affairs (Washington, DC)			On May 3, data of all American veterans who were discharged since 1975 including names, Social Security numbers, dates of birth and in many cases phone numbers and addresses, were stolen from a VA employee's home. Theft of the laptop and computer storage device included data of 26.5 milliion veterans. The employee was not authorized to take the files home to work on a data collation project. The data did not contain medical or financial information, but may have disability numerical rankings. UPDATE: An additional 2.1 million active and reserve service members were added to the total number of affected individuals June 1st. UPDATE (06.29.06): The stolen laptop computer and the external hard drive were recovered.				28,600,000
June 1, 2006	Miami University (Oxford, OH)			An employee lost a hand-held personal computer containing personal information of students who were enrolled between July 2001 and May 2006.				851
June 1, 2006	Ernst & Young (UK)			A laptop containing names, addresses and credit or debit card information of Hotels.com customers was stolen from an employee's car in Texas.				243,000
June 2, 2006	YMCA (Providence, RI)			Laptop computer containing personal information of members was stolen. The information included credit card and debit card numbers, checking account information, Social Security numbers, the names and addresses of children in daycare programs and medical information about the children, such as allergies and the medicine they take, though the type of stolen information about each person varies.				65,000
June 5, 2006	Internal Revenue Service (Washington, DC)			A laptop computer containing personal information of employees and job applicants, including fingerprints, names, Social Security numbers, and dates of birth, was lost during transit on an airline flight				291
June 16, 2006	Union Pacific (Omaha, NE)			On April 29th, an employee's laptop was stolen that contained data for current and former Union Pacific employees, including names, birth dates and Social Security numbers.				30,000
June 17, 2006	ING (Washington, D.C.)			Laptop stolen from employee's home containing retirement plan information including Social Security numbers of D.C. city employees.				13,000
June 20, 2006	Equifax (Atlanta, GA)			On May 29, a company laptop containing employee names and partial and full Social Security numbers was stolen from an employee.				2,500
June 22, 2006	Fed. Trade Comm. (FTC) (Washington, D.C.)			Two laptop computers containing personal and financial data were stolen from an employee's vehicle. The data included names, addresses, Social Security numbers, dates of birth, and in some instances, financial account numbers gathered in law enforcement investigations.				110
June 23, 2006	San Francisco State Univ. (San Francisco, CA)			a faculty member's laptop was stolen from a car on June 1 that contained personal information of former and current students including Social Security numbers, and names and ins some instance, phone numbers and grade point averages.				3,000