Feeds

Ernst & Young fails to disclose high-profile data loss

Sun CEO's social security number exposed

Using blade systems to cut costs and sharpen efficiencies

Exclusive Ernst and Young should go ahead and pony up for its own suite of transparency services. The accounting firm failed to disclose a high profile loss of customer data until being confronted by The Register.

Ernst and Young has lost a laptop containing data such as the social security numbers of its customers. One of the people affected by the data loss appears to be Sun Microsystems CEO Scott McNealy, who was notified that his social security number and personal information have been compromised. While pushing all out transparency for its customers, Ernst and Young failed to cop to the security breach until contacted by us.

"We deeply regret that a laptop containing confidential client information was stolen, in what appears to be a random act, from the locked car of one of our employees," said Ernst and Young spokesman Charles Perkins. "The security and confidentiality of our client information is of critical importance to us. The computer was password-protected, and we have no reason to believe the data itself was targeted or that the information was accessed by anyone. We are notifying those clients whose information was contained on the computer."

Ernst and Young declined to comment on whether or not McNealy was affected.

However, at lat week's RSA security conference, McNealy noted that he received an e-mail from an "anonymous partner" detailing a loss of his private data. "We determined that your name and social security number were among the data (lost)," the partner wrote to McNealy.

"This is an organization that we spend an enormous amount of money on to determine whether we are Sarbanes-Oxley compliant," McNealy said.

Digging through Sun's financial filings, you'll discover that Ernst and Young serves as the company's auditor and handles Sarbanes-Oxley consulting for Sun. A spokesman at Sun confirmed that Ernst and Young is still the company's auditor but declined to out the firm that lost McNealy's data.

It's difficult to determine how massive the Ernst and Young data loss was in this case. Although, today we learned that a Deloitte and Touche CD containing information on McAfee employees was left in an airline seat pocket, exposing the social security numbers of close to 9,000 workers. Certainly, a laptop loss could be as damaging.

Ernst and Young declined to return our phone calls seeking more information about the breach and why it has "no reason to believe" the password could be cracked. It makes no mention of stronger security than simple password protection. The company only sent along the earlier statement.

Ernst and Young has littered its web site with transparency advice for customers. The company, however, failed to make a public notification of the data loss.

Such secrecy seems quite rich given the current climate surrounding security and the protection of customer data. One might ask how a company such as Ernst and Young can judge the transparency of Sun or other customers.

Then again, the accounting firm could just stick with the "You have no privacy. Get over it" line. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.