The Choicepoint Data Security BreachWhat is Choicepoint?Where do aggregators get information?What kind of information is in Choicepoint’s data base?What are Choicepoint’s records used for?Who does it sell to?Examples of reportsSlide 8What was the problem?How widespread is the problem?How was it discovered?Now what?Slide 13What should consumers do?The Choicepoint Data The Choicepoint Data Security BreachSecurity BreachFebruary, 2005February, 2005What is Choicepoint?What is Choicepoint?Atlanta-based company spun off from Atlanta-based company spun off from Equifax (CRA) in 1977Equifax (CRA) in 1977One of the largest data aggregators One of the largest data aggregators and resellers in the USand resellers in the USCompiles, stores and sells Compiles, stores and sells information about virtually every US information about virtually every US adultadult19 billion records19 billion recordsWhere do aggregators get Where do aggregators get information?information?Public recordsPublic records•Court recordsCourt records•Property tax assessor filesProperty tax assessor files•Professional licensesProfessional licenses•Vehicle registrationsVehicle registrations•Bankruptcy recordsBankruptcy records•Deed transfersDeed transfersCredit reportsCredit reportsWhat kind of information is in What kind of information is in Choicepoint’s data base?Choicepoint’s data base?Names, addresses and phone Names, addresses and phone numbersnumbersSocial security numbersSocial security numbersMilitary recordsMilitary recordsCredit reportsCredit reportsMedical historiesMedical historiesWhat are Choicepoint’s records What are Choicepoint’s records used for?used for?Credit reportsCredit reportsEmployment background checksEmployment background checksTenant rental historyTenant rental historyInsurance claimsInsurance claimsWho does it sell to?Who does it sell to?EmployersEmployersLandlordsLandlordsDebt collectorsDebt collectorsLoan officersLoan officersMedia organizationsMedia organizationsLaw officesLaw officesLaw enforcement agenciesLaw enforcement agenciesHomeland security officialsHomeland security officialsExamples of reportsExamples of reportsTenant rental historyTenant rental history•Landlord debtLandlord debt•Criminal recordCriminal record•EvictionsEvictions•Registered sex offenderRegistered sex offender•FBI searchesFBI searchesEmployment background checkEmployment background check•Arrest and conviction historyArrest and conviction history•Prison, parole and release recordsPrison, parole and release records•Credit historyCredit history•Employment verificationEmployment verification•Education verificationEducation verification•License credentialsLicense credentials•Business or personal reference Business or personal reference verificationverificationWhat was the problem?What was the problem?Identity thieves established phony businessesIdentity thieves established phony businesses•Check cashingCheck cashing•Debt collectionDebt collectionUsed Kinko’s and Mail Boxes, Etc. to fax and Used Kinko’s and Mail Boxes, Etc. to fax and receive mailreceive mailEstablished 50 separate accounts with Established 50 separate accounts with ChoicepointChoicepointUsed accounts to access consumers’ personal Used accounts to access consumers’ personal informationinformationOperated more than a year before detectedOperated more than a year before detectedUsed information to defraud at least 750 people Used information to defraud at least 750 people (so far)(so far)How widespread is the problem?How widespread is the problem?Affects consumers in all 50 states and Affects consumers in all 50 states and three US territoriesthree US territoriesChoicepoint estimates 145,000 consumers Choicepoint estimates 145,000 consumers affectedaffected•High of 34,000 in CaliforniaHigh of 34,000 in California•Low of 2 in US Virgin IslandsLow of 2 in US Virgin Islands•111 in Vermont111 in VermontCalifornia authorities fear up to 500,000California authorities fear up to 500,000Also concerns related to redirected mail Also concerns related to redirected mail belonging to 700 people found at sitesbelonging to 700 people found at sitesHow was it discovered?How was it discovered?October 2004 Choicepoint detected October 2004 Choicepoint detected signs of fraudulent activities in small signs of fraudulent activities in small business accounts in Los Angelesbusiness accounts in Los Angeles•Requests for data faxed from Kinko’sRequests for data faxed from Kinko’sNotified LA County Sheriff’s Notified LA County Sheriff’s DepartmentDepartmentSting operation resulted in arrest and Sting operation resulted in arrest and conviction of a Nigerian citizenconviction of a Nigerian citizenNow what?Now what?Choicepoint notified California Choicepoint notified California residents under California law residents under California law requiring notification to those requiring notification to those threatened when security breachedthreatened when security breachedAttorneys general of 38 states Attorneys general of 38 states demanded notification to all demanded notification to all consumers who may have been consumers who may have been affectedaffectedChoicepoint has also agreed to:Choicepoint has also agreed to:Rescreen its 17,000 business Rescreen its 17,000 business customers to assure legitimacycustomers to assure legitimacyPay for one-year membership in Pay for one-year membership in credit monitoring service for all credit monitoring service for all consumers affectedconsumers affectedWhat should consumers do?What should consumers do?All consumers should check credit All consumers should check credit reports once per year (free)reports once per year (free)Consumers who receive notification Consumers who receive notification from Choicepoint should place a from Choicepoint should place a fraud alert on their credit reportsfraud alert on their credit reports•Creditors will then contact consumer Creditors will then contact consumer before granting any credit requestsbefore granting any credit