Feeds

40,000 BP workers exposed in Ernst & Young laptop loss

Sun, IBM and Cisco welcome BP to club

Internet Security Threat Report 2014

Exclusive Like sands through the hourglass, these are The Days of Ernst & Young laptop loss. Yes, friends, The Register can confirm that BP has been added to the list of Ernst & Young customers whose personal data has been exposed after a laptop theft. BP joins Sun Microsystems, Cisco and IBM in this not so exclusive club.

Ernst & Young has sent out a letter to all 38,000 BP employees in the US, telling them that a laptop theft had exposed their names and social security numbers. To keep the BP staff's mind at ease, Ernst & Young said that the file name containing their info did not indicate what type of information was on the laptop, and the laptop was password protected. Phew!

Ernst & Young confirmed that this is the very same laptop that held data on the Sun, Cisco and IBM workers. All of these data losses were revealed by us in a set of exclusive stories. Ernst & Young also recently lost four more laptops in Miami, although it has not said which customers were affected in those incidents.

Oddly, the Ernst & Young saga has gone untouched by other media outlets. That's somewhat surprising given the vigor with which security reporters chased down our initial confirmation yesterday that a Fidelity Investments laptop loss had exposed the personal information of 200,000 HP employees.

Ernst & Young continues to maintain a code of silence around the laptop thefts, saying only that the BP/Sun/IBM/Cisco machine was password protected. This speak no evil policy has resulted in a string of stories as Ernst & Young customers are told one by one about the theft.

It's difficult to obtain an exact figure on how many people have been affected by Ernst & Young's security lapse given that it won't say anything on the subject. We do, however, know that the IBM data breach exposed all current and former employees who have worked overseas at some point in their career. So, we're likely talking well over 100,000 people in that one incident.

You have to wonder how long these thefts can continue before the financial services companies start explaining why key customer data was sitting on laptops and why workers felt it okay to leave these laptops in their cars or in conference rooms. The lack of action on their part will no doubt encourage legislators to step in at some point.

Keep your letters coming. ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.