Feeds

Ernst & Young fails to disclose high-profile data loss

Sun CEO's social security number exposed

Website security in corporate America

Exclusive Ernst and Young should go ahead and pony up for its own suite of transparency services. The accounting firm failed to disclose a high profile loss of customer data until being confronted by The Register.

Ernst and Young has lost a laptop containing data such as the social security numbers of its customers. One of the people affected by the data loss appears to be Sun Microsystems CEO Scott McNealy, who was notified that his social security number and personal information have been compromised. While pushing all out transparency for its customers, Ernst and Young failed to cop to the security breach until contacted by us.

"We deeply regret that a laptop containing confidential client information was stolen, in what appears to be a random act, from the locked car of one of our employees," said Ernst and Young spokesman Charles Perkins. "The security and confidentiality of our client information is of critical importance to us. The computer was password-protected, and we have no reason to believe the data itself was targeted or that the information was accessed by anyone. We are notifying those clients whose information was contained on the computer."

Ernst and Young declined to comment on whether or not McNealy was affected.

However, at lat week's RSA security conference, McNealy noted that he received an e-mail from an "anonymous partner" detailing a loss of his private data. "We determined that your name and social security number were among the data (lost)," the partner wrote to McNealy.

"This is an organization that we spend an enormous amount of money on to determine whether we are Sarbanes-Oxley compliant," McNealy said.

Digging through Sun's financial filings, you'll discover that Ernst and Young serves as the company's auditor and handles Sarbanes-Oxley consulting for Sun. A spokesman at Sun confirmed that Ernst and Young is still the company's auditor but declined to out the firm that lost McNealy's data.

It's difficult to determine how massive the Ernst and Young data loss was in this case. Although, today we learned that a Deloitte and Touche CD containing information on McAfee employees was left in an airline seat pocket, exposing the social security numbers of close to 9,000 workers. Certainly, a laptop loss could be as damaging.

Ernst and Young declined to return our phone calls seeking more information about the breach and why it has "no reason to believe" the password could be cracked. It makes no mention of stronger security than simple password protection. The company only sent along the earlier statement.

Ernst and Young has littered its web site with transparency advice for customers. The company, however, failed to make a public notification of the data loss.

Such secrecy seems quite rich given the current climate surrounding security and the protection of customer data. One might ask how a company such as Ernst and Young can judge the transparency of Sun or other customers.

Then again, the accounting firm could just stick with the "You have no privacy. Get over it" line. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.