Feeds

US service personnel at risk of ID theft

Half a million people's records sent unencrypted

Internet Security Threat Report 2014

Personal details of over half a million US service personnel and their relatives may have been compromised by a Pentagon contractor.

Science Applications International Corporation (SAIC), a Fortune 500 tech-services provider, announced on Friday that:

"Personal information of certain uniformed service members, family members, and others was placed at risk for potential compromise while being processed by SAIC."

The risk of compromise was incurred because the relevant data was sent over the internet without use of any encryption. There is no special reason to believe that it was intercepted, but "the possibility cannot be ruled out".

SAIC said it was notifying 580,000 households, some with more than one person affected. Different information may have been compromised for different individuals, but the data included names, addresses, Social Security numbers, birth dates, and "limited" health information. The data was held under a health benefits programme for the uniformed services and their families.

SAIC expects to spend between $7m and $9m - approximately 0.1 per cent of its annual revenues - dealing with the consequences of the lapse, though this figure could be larger if widespread identity theft occurs. The firm has retained security giant Kroll to offer assistance to affected service people. This will include an Incident Response Centre and help for those who fall victim to identity theft as a result of the SAIC leak.

"We deeply regret this security failure and I want to extend our apologies to those affected by it," SAIC chairman and CEO Ken Dahlberg said. "The security failure is completely unacceptable and occurred as a result of clear violations of SAIC's strong internal IT security policies. In this instance, we did not live up to the high level of performance that our customers have learned to expect and demand from us. We let down our customers and the service members whom we support. For this, we are very sorry."

Interestingly, the Associated Press reports that SAIC first became aware of the leak after being notified by US Air Force personnel in Europe that they had detected sensitive information being transmitted in clear across the net.

The company says it has "placed a number of employees on administrative leave" pending the outcome of investigations. ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.