***Update:Tape Found!*** ABN AMRO/LaSalle Bank Loses Data Tape on 2 Mil Customers Containing S.S.#'s

UPDATE: TAPE HAS BEEN RECOVERED - I HOPE ABN AMRO HAS LEARNED A VALUABLE LESSON

This is unbelieveable. Check out the official comment about how they "hoped it fell into a garbage can."

ABN Amro loses tape with data on 2 million mortgage customers; claims no customer identities compromised

By Tom Henderson
Dec. 16, 2005 11:09 AM

ABN Amro Mortgage Group Inc., a subsidiary of Chicago-based LaSalle Bank Corp., admitted Friday that it had lost a computer tape nearly a month ago containing data for about 2 million residential-mortgage customers.

Data on the tape included the names of the customers, payment histories, account information and Social Security numbers.

About 320,000 are customers of Troy-based LaSalle Bank Midwest, which changed its name from Standard Federal Bank in September.

The company said the tape was lost while being transported by DHL from the mortgage company’s data-processing center in Chicago to a center in Allen, Texas, operated by Experian, one of the national credit-reporting agencies.

A package containing the tape was picked up Nov. 18 and never arrived at the Experian site. In the news release issued by ABN Amro Mortgage, no explanation was given for the delay between the time the tape was sent and the acknowledgment that it was missing.

“There have been no reports of anybody’s identity being compromised. Our hope is when it was lost, it fell into a garbage can or something,” said Robert Darmanin, vice president and director of corporate relations for LaSalle Bank Midwest. “We couldn’t be more disappointed.”

Thomas Goldstein, chairman and CEO of ABN Amro Mortgage, said in a statement, “We understand that this incident may cause concern for our customers, and we deeply regret that it has occurred. We have been notifying our customers and are dedicating resources to assist them and to answer any questions they have.”

Goldstein said the company is offering to enroll its mortgage customers in a credit-monitoring service of their choice for 90 days at no cost to them. He also said the company no longer delivers physical copies of data but transmits them by encrypted electronic means.

Darmanin said the tape was a copy and said the bank has lost no information.

Yeah. So much for the whole idea of being safe by not showing your id to the cashier, eh?

Why did they delay? Hmmmm, partly the old "bury bad news on Friday" and a desire to avoid for as long as possible those pesky new reporting requirements.

Somehow I doubt it's in the garbage can. I wonder if the DHL guy is running a business on the side? Sounds suspicious.

dweick said: unknownshopper said: Yeah. So much for the whole idea of being safe by not showing your id to the cashier, eh?

Why did they delay? Hmmmm, partly the old "bury bad news on Friday" and a desire to avoid for as long as possible those pesky new reporting requirements.

I don't think anyone has argued you are "safe" if you don't show your ID to a cashier. I think you are safer. Kind of like wearing a seatbelt, it doesn't make you safe but I think it adds to your safety.

Sending unencrypted tapes around the country by mail is just asking for trouble. How long is it going to be before the banks start being held responsible for the damage they cause thru their careless disregard for their customer's personal information?

News articles like this should be printed and saved for the day you have fraudulent activity on one of your accounts and the bank tries to say it must have been your fault because their have such wonderful security measures in place.

Absolutely.

The banks might as well strap your data on the leg of a carrier pigeon, in the form of writings on napkin, and send the pigeon on its way. It's totally unacceptable and ridiculous.

I hope there is a severe and swift market punishment of ABN AMRO/Lasalle Bank for being so stupid.

Also, if any data is used for illegal purposes, the bank should bear full responsibility for restoring ny financial losses that occur, and repairing credit damage. That's the bare minimum. Arguably, they should be financially punished just for being so sloppy and casual in the way they handled this data.

BankruptThem said: The banks might as well strap your data on the leg of a carrier pigeon, in the form of writings on napkin, and send the pigeon on its way. It's totally unacceptable and ridiculous.

I hope there is a severe and swift market punishment of ABN AMRO/Lasalle Bank for being so stupid.

Also, if any data is used for illegal purposes, the bank should bear full responsibility for restoring ny financial losses that occur, and repairing credit damage.

1. If they could save a buck that way they would.
2. There won't be. And posting the story right before lunch on a Friday just helps to ensure that.
3. Not in this Congress.

edit: FWIW, thanks for using "loses" and not "looses" in your title.

given the inaction of the federal regulatory agencies, is there any chance of starting a class action lawsuit? Perhaps a lawyer can weigh in. The argument would be negligence for using such sloppy mailing systems. Or is using DHL to transfer sensitive data considered industry practice? IF it is, we have a larger problem.

1. They waited almost a month to act?
2. They are offering a lousy three months of credit monitoring as a result?
3. How on earth could something this sensitive fall into a garbage can? Did they pile up a bunch of tapes in the back of a truc, loose?

I hope they get body slammed for this.

unknownshopper said:

edit: FWIW, thanks for using "loses" and not "looses" in your title.

Agreed. How hard is it to spell and use this word properly?

BankruptThem said:
2) I want to know why they are transporting such highly sensitive data (account numbers with social security numbers) in such a casual, sloppy way.


I'm curious what you would suggest as a good way to ship sensitive data. I would not think it to be unreasonable to argue that DHL is more secure than the USPS, but how many people mail tax returns?

ciba said: BankruptThem said:
2) I want to know why they are transporting such highly sensitive data (account numbers with social security numbers) in such a casual, sloppy way.


I'm curious what you would suggest as a good way to ship sensitive data. I would not think it to be unreasonable to argue that DHL is more secure than the USPS, but how many people mail tax returns?

USPS Registered Mail

Encrypt the data, if you can't encrypt it then at least put it in packaging that is tamper resistant so you can tell if someone mucked with it in transit.

zuttopretear said: I have mortgage account with them, and if they had notified the incident to their customers,i do not know about it. also to think that they only offer credit monitoring service for 90 days is rediculous, most crimes would occur long after that as we would loose our guard with time span, not in the first few months when the news is still so fresh to us. not long ago ameritrade also lost computer tape and they offered to monitor my credits for a year, i've since checked my accounts closely.

I haven't heard from them, either, and with 2 million identities to work with, it could take a while for folks to get around to using mine. 90 days is not enough.

I also wonder, can't they figure out with some reasonable degree of accuracy when the tape disappeared? I haven't looked into how DHL handles things, but with tracking like Fedex, they should at least be able to know that the last place it was handled was going onto flight ### or a truck at the LA distribution center, etc. That should narrow down finding where or at least who likely lost/took it.

But there aren't.

At least not to the extent you might desire.

HawkeyeNFO said: teplitsa said: I've heard that the US Government sends classified info via registered mail, but not 100% sure.

That's a fact, Jack! Classified info up to at least the secret level, needs only to be double wrapped. Then it's in the hands of the good ol' post office. Mr. McFeeley probably doesn't have a clearance, but he carries classified info daily.

Chances are Mr. McFeeley does have a low-level security clearance.

I'm a mortgage customer of theirs, and apparently my info was on the tape (I called them when I saw this post). I told them that they took too long to tell me, and they basically advertised to whoever has the tape, that if they plan to use it maliciously, to wait 90 days before starting. I asked them for more than 90 days of credit monitoring protection, and got nothing.

If anyone has any better luck getting something other than an apology, please let me know either here, or privately.

FWIW, here's a link to their statement: http://info.mortgage.com/

Thanks.

GoDougGo said: I'm a mortgage customer of theirs, and apparently my info was on the tape (I called them when I saw this post). I told them that they took too long to tell me, and they basically advertised to whoever has the tape, that if they plan to use it maliciously, to wait 90 days before starting. I asked them for more than 90 days of credit monitoring protection, and got nothing.

If anyone has any better luck getting something other than an apology, please let me know either here, or privately.

FWIW, here's a link to their statement: http://info.mortgage.com/

Thanks.

I spoke with their Troy, Michigan HQ today (LaSalle).

They are reviewing their response to this incident and may offer longer term credit monitoring.

People who are customers of ABN AMRO, LaSalle Bank (formerly Standard Federal) need to email, write letters and call to tell them that their initial response is pathetic and inadequate.

BankruptThem said: People who are customers of ABN AMRO, LaSalle Bank (formerly Standard Federal) need to email, write letters and call to tell them that their initial response is pathetic and inadequate.

Actually, they need to write their lapdog congressmen/women.

This kind of exposure is not new. The only thing that's new is that there are requirements to make the exposure public, if unbelievely long after the fact. But the rules are that way because your congressmen caved.

The banks really only care about following the rules. And if it ain't in the rules, you can pound sand from now til doomsday and they ain't gonna care.

Until it costs less to do it more securely than it does to do it unsecurely and pay the fines, you ain't going to see measurable improvement.

I run Veritas at work and I don't think you need all that. The data is in tar format on the tape if i'm not mistaken. It's like Unix's version of Winzip and there are tons of free readers on the internet.

I haven't tried it, but may do so just for fun. I think all you need is the drive, computer connection and a way to read tar files on the tape. And then whatever way to read the data in the file. If it's SQL than something to read a SQL or Oracle database, etc.

If ABN is on LTO 2 or 3 than it's good since it will cost the thief a lot of money to buy the equipment unless they already stole it. If it's DLT tapes than they are screwed.

Where I work we are looking at a disk to disk backup system to make things like this old news. We are actually looking at Evault, and they said that BoA is a customer of theirs.

registered mail is shipped in locked and sealed containers and signed for every step of the way. Every time it changes hands, there is a signature and therfore a paper trail for audit purposes.

unknownshopper said: The banks really only care about following the rules. And if it ain't in the rules, you can pound sand from now til doomsday and they ain't gonna care.

Until it costs less to do it more securely than it does to do it unsecurely and pay the fines, you ain't going to see measurable improvement.and this is the bottom line

Easiest solution would be to close all offices except those in cities where there is door to door tape pick up

I am angry also, but it sounds like DHL is more to blaime than ABN.