MTA Workers' Personal Information Found On CD That Was Sold
NEW YORK (CBSNewYork/AP) -- The Social Security numbers and other personal information of about 15,000 New York Metropolitan Transportation Authority workers has appeared on a CD inside a refurbished CD drive sold by a retailer, according to a letter obtained by The Associated Press.
The MTA said an investigation is under way `to determine the cause of this security breach.'' A complaint also has been filed with the New York Police Department; an NYPD spokesman did not immediately comment.
``While we do not suspect nor have seen any evidence of misuse of the data, every precaution is being taken to ensure that this is the case,'' the March 6 letter from MTA Chief Information Officer Sidney Gellineau said.
A spokesman for the MTA referred a reporter to the content of the letter for comment.
The Transit Authority said a customer of an unnamed major retailer purchased a refurbished CD drive for her personal use. That customer discovered the drive contained a CD that had a list of about 15,000 active, retired, deceased and former New York City Transit employees, along with certain personal information -- including Social Security numbers, dates of birth, earnings information and other data.
The list includes employees holding positions in various titles, and levels throughout the organization, Gellineau said.
No hourly employees were on the list, the MTA said.
Coincidentally, the customer who bought the computer turned out to be an employee of a vendor that works with the MTA. That person reported the discovery to her employer, who returned it to the Transit Authority's attorney.
Gellineau said in the letter that the vendor returned the CD without making a copy.
While thefts of personal information committed by hackers have grabbed headlines lately – notably including a major security breach at Target late last year – experts say it's also not uncommon for personal data to be exposed accidentally.
Beth Diamond, a global claims leader at the insurance company Beazley, said it's entirely possible that the exposure of the personal information resulted from an act of carelessness. She noted that companies and other entities often donate old equipment to nonprofits, who then may in turn sell the equipment to retailers if they don't have a use for it. The disc could have accidentally been left inside when that happened.
Employees also will sometimes look for old equipment at their workplaces that they can steal and resell. And it's possible that a MTA employee copied some data for work-at-home purposes, forgot about the CD and then sold the drive with it inside.
But even in cases where the data is lost and not stolen, disaster can occur. Diamond said there have been cases where businesses such as real estate offices closed down and didn't properly dispose of their clients' personal information, which was then found by criminals.
``If the wrong individuals stumble upon it, they can realize that it can be a gold mine,'' she said.
In order to prevent accidental breaches, Diamond said many companies put restrictions on employee computers that prevent them from copying files to take home. But no matter how many precautions are taken, breaches caused by human error are inevitable, she said.
The MTA letter noted that the placement of unencrypted personal information on a CD was a violation of its policy. ``We are not aware of any other such violation of the policy.''
You May Also Be Interested In These Stories
(TM and © Copyright 2014 CBS Radio Inc. and its relevant subsidiaries. CBS RADIO and EYE Logo TM and Copyright 2014 CBS Broadcasting Inc. Used under license. All Rights Reserved. This material may not be published, broadcast, rewritten, or redistributed. The Associated Press contributed to this report.)
