Feeds

Data for 800,000 job applicants stolen

Mind the Gap

Choosing a cloud hosting partner with confidence

A laptop containing unencrypted personal information for 800,000 people who applied for jobs with clothing retailer Gap Inc. has been stolen.

The computer contained social security numbers and other sensitive information belonging to residents of the US and Puerto Rico who applied online or by phone for jobs from July 2006 to June 2007, the retailer said in this list of frequently asked questions. Details for applicants living in Canada were also exposed, although they didn't include social insurance numbers.

The laptop was stolen from the offices of a third-party vendor the Gap hired to manage applicant data. The Gap didn't identify the vendor or explain why it failed to encrypt such a large number of applicants' personal information.

Gap joins scores of other organizations that have lost sensitive information entrusted to them. The US Department of Veterans Affairs, IBM and VeriSign have also been dogged by laptops or storage tapes that weren't encrypted and were later lost or stolen.

More recently, high-stakes data breaches have resulted from criminals who found ways to exploit weaknesses in corporate networks. Last week, TD Ameritrade said hackers infiltrated a database containing social security numbers, birth dates and account numbers on an undisclosed number of clients. And in August, cyber gumshoes discovered a Trojan that stole more than 1.3 million records from people who were looking for work through job recruiter Monster.com.

Few companies disclose details of their data-retention policies, such as whether computers containing sensitive information are encrypted. This is partly because the release of too much information can tip off criminals. But we can't help thinking the lack of disclosure also gives lawyers wriggle room in the event something goes wrong.

Indeed, Gap's FAQ didn't say whether customer records, applicant information and other sensitive details in its possession are encrypted, or whether it plans to enforce such a policy in the future. The Associated Press, however, quoted Glenn Murphy, the company's CEO and chairman saying the storing of applicant data without encrypting it ran contrary to Gap's agreement with the third-party vendor.

Gap is contacting applicants based in the US and Puerto Rico who had their social security numbers exposed. It is also arranging for them to receive one year of free credit monitoring. The company said it is unaware of any of the data being misused. ®

Intelligent flash storage arrays

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Free virtual appliance for wire data analytics
The ExtraHop Discovery Edition is a free virtual appliance will help you to discover the performance of your applications across the network, web, VDI, database, and storage tiers.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.