Data Theft At Major Arizona Mortgage Company Leaves Many Questions Unanswered
Major incidents of data theft seem to be occurring with alarming frequency. Even companies with considerable resources seem powerless to prevent the theft of customer records containing sensitive personal and financial data.
Two recent cases involving Michaels Stores and Sony Corp show that even huge companies are vulnerable to hackers. I will leave it up to the experts to determine whether these data thefts are due to inadequate security protocols, but when they do occur, the company involved should take prompt and serious actions to ensure that damage to customers and employees is limited.
A serious case of data theft has occurred at The Lending Company, a major Arizona mortgage company based in Phoenix, Arizona. In a letter sent to current and former employees, The Lending Company said,
“We are contacting you about a potential problem involving identity theft. Recently, we have learned of a data security incident in which someone accessed and potentially downloaded sensitive personnel records including names, contact information, and social security numbers. We have notified law enforcement regarding the incident and have provided them with a general report. Due to the nature of this incident we strongly encourage you to take preventative measures to help prevent and detect any misuse of your information.
We recommend that you place a fraud alert on your credit file…You are encourage to call any one of the three major credit bureaus listed below.”
The Lending Company also suggested that these additional steps be taken:
- Check your credit report periodically
- Review a copy of the comprehensive FTC guide to guard against identity theft
- Contact local law enforcement and file a report if you find suspicious activity on your credit report
- File a complaint with the FTC which will add your complaint to their Identify Theft Data Clearinghouse
The response of The Lending Company to this serious case of data theft leaves potential victims of identity theft with many unanswered questions including:
- How long was it between the data theft and the date is was discovered?
- Why were potential victims not immediately notified by email or a phone call instead of being informed by “snail mail”?
- The letter only mentions a theft of personnel records. Is there also a possibility that the theft of customer loan records occurred, potentially exposing thousands of borrowers to identity theft?
- Did The Lending Company have reasonable security measures in place to protect customer and employee data?
The Lending Company gave a long list of chores to the victims to minimize their potential losses and aggravation due to identity theft. Dealing with the credit bureaus, FTC and law enforcement involves a huge time commitment. Why is The Lending Company not stepping forward with a help line or live support to deal with multiple agencies regarding a data breach that is ultimately the responsibility of The Lending Company?
It is routine in cases involved compromised financial information for the company involved to offer free credit monitoring through a credit bureau which sends alerts regarding potential credit and identity theft risks. The credit monitoring services also have a team ready to assist victims with fraud resolution and provide identity theft insurance coverage.
The Lending Company is ultimately responsible for the data theft yet has done nothing to assist potential victims other than sending them a letter which basically says “good luck” with your efforts to stop identity theft or fraud that may occur due to data stolen from The Lending Company’s offices.
Companies should be required by law to take immediate steps to protect customers and employees in the case of theft of personal and financial records. At a minimum, companies who allow sensitive data to be stolen should provide at no charge the best credit and fraud monitoring services available.
The Lending Company has failed to protect data and has now failed to help those who may be at risk of identity theft or worse. Hopefully, The Lending Company will recognize its responsibility and immediately take more proactive steps to protect its customers and employees.