http://www.informationweek.com/news/showArticle.jhtml?articleID=198702184 

By Sharon Gaudin
InformationWeek
April 3, 2007

The Texas attorney general has charged RadioShack with violating 
identity protection laws by dumping thousands of customer records in a 
garbage bin behind a Texas store.

Texas Attorney General Greg Abbott hit the retailer Monday with two 
charges. One of the charges carries a penalty of up to $50,000 for each 
violation and one has a penalty of up to $500 for each abandoned record. 
Abbott contends RadioShack's actions exposed its customers to identity 
theft since the records contained names, addresses, Social Security 
numbers, and credit card information.

The Attorney General's Office is investigating whether the tossed 
information has been used in identity theft crimes.

Steve Schmidt, an area VP for RadioShack, called the breach an isolated 
incident. The consumer electronics chain operates around 4,500 stores.

"We are aware of today's action by the Texas Attorney General's office, 
and we fully intend to work amicably with them in reaching a resolution 
to the matter," said Schmidt in an e-mail statement. "RadioShack takes 
seriously its obligation to maintain and safeguard all company records, 
especially when they contain a customer's non-public information. Our 
Northshore Plaza store in Portland, Texas, is part of a shredding 
program we have in place throughout the state for the secure disposal 
and destruction of such documents as required by Texas law. In this 
isolated instance, the store did not act in accordance with this 
program. However, we moved quickly to reclaim and secure those 
documents."

The Attorney General's Office launched an investigation after receiving 
reports that RadioShack employees dumped bulk customer records in 
garbage containers behind a store in Portland, which is near Corpus 
Christi, according to a release from the AG's office. Investigators 
found the records contained sensitive customer information, including 
Social Security numbers, credit and debit card information, names, 
addresses, and telephone numbers.

The records included personal information from one customer's 1998 
credit application and a receipt from a local woman who purchased a 
shredder from RadioShack to protect herself from identity theft, the 
attorney general reported. Sensitive information from a credit card 
issued to the city of Portland also was discovered among the discarded 
records.

"Identity theft is one of the fastest growing crimes in the United 
States," Abbott said. "Texans expect their personal information to be 
protected. The Office of the Attorney General will take all necessary 
steps to ensure that consumers are protected from identity thieves."

Abbott charged RadioShack with violating provisions of the state's 2005 
Identity Theft Enforcement and Protection Act, which requires the 
protection and proper destruction of clients' sensitive personal 
information. He also charged the company with violations under Chapter 
35 of the state's Business and Commerce Code, which requires businesses 
to develop retention and disposal procedures for their clients' personal 
information.

Consumers who interacted with the Portland store are being warned to 
carefully monitor bank, credit card, and any similar statements for 
evidence of theft. Customers also should consider obtaining free copies 
of their credit reports.

Consumers who wish to file a complaint may contact the Attorney 
General's Office at 800-252-8011 or file a complaint online at this 
site, where they also can obtain information on how to detect and 
prevent identity theft.


__________________________
Subscribe to InfoSec News
http://www.infosecnews.org