Data for 800,000 job applicants stolen

Data for 800,000 job applicants stolen
Data for 800,000 job applicants stolen

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.

Content-Transfer-Encoding: QUOTED-PRINTABLE

By Dan Goodin in San Francisco
28th September 2007

A laptop containing unencrypted personal information for 800,000 people 
who applied for jobs with clothing retailer Gap Inc. has been stolen.

The computer contained social security numbers and other sensitive 
information belonging to residents of the US and Puerto Rico who applied 
online or by phone for jobs from July 2006 to June 2007, the retailer 
said in this list [1] of frequently asked questions. Details for 
applicants living in Canada were also exposed, although they didn't 
include social insurance numbers.

The laptop was stolen from the offices of a third-party vendor the Gap 
hired to manage applicant data. The Gap didn't identify the vendor or 
explain why it failed to encrypt such a large number of applicants' 
personal information.

Gap joins scores of other organizations that have lost sensitive 
information entrusted to them. The US Department of Veterans Affairs, 
IBM and VeriSign have also been dogged by laptops or storage tapes that 
weren't encrypted and were later lost or stolen.

More recently, high-stakes data breaches have resulted from criminals 
who found ways to exploit weaknesses in corporate networks. Last week, 
TD Ameritrade said hackers infiltrated a database containing social 
security numbers, birth dates and account numbers on an undisclosed 
number of clients. And in August, cyber gumshoes discovered a Trojan 
that stole more than 1.3 million records from people who were looking 
for work through job recruiter

Few companies disclose details of their data-retention policies, such as 
whether computers containing sensitive information are encrypted. This 
is partly because the release of too much information can tip off 
criminals. But we can't help thinking the lack of disclosure also gives 
lawyers wriggle room in the event something goes wrong.

Indeed, Gap's FAQ didn't say whether customer records, applicant 
information and other sensitive details in its possession are encrypted, 
or whether it plans to enforce such a policy in the future. The 
Associated Press, however, quoted Glenn Murphy, the company's CEO and 
chairman saying the storing of applicant data without encrypting it ran 
contrary to Gap's agreement with the third-party vendor.

Gap is contacting applicants based in the US and Puerto Rico who had 
their social security numbers exposed. It is also arranging for them to 
receive one year of free credit monitoring. The company said it is 
unaware of any of the data being misused. =C2=AE


Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

CSI 2007 is the only conference that delivers a business-focused
overview of enterprise security. It will convene 1,500+ delegates,
80 exhibitors and features 100+ sessions/seminars providing a
roadmap for integrating policies and procedures with new tools
and techniques.  Register now for savings on conference fees   
and/or free exhibits admission. - 


Site design & layout copyright © 1986-2014 CodeGods