Wells Fargo Code Used To Illegally Access Consumer Data

Wells Fargo Bank N.A is in the process of notifying some 7,000 individuals that a thief may have accessed their Social Security numbers and other personal information by illegally using the financial services firm's access codes

By Jaikumar Vijayan, Computerworld

August 12, 2008 — CSO —

Wells Fargo Bank N.A is in the process of notifying some 7,000 individuals that a thief may have accessed their Social Security numbers and other personal information by illegally using the financial services firm's access codes.

The bank learned of the compromise on July 1 when MicroBilt Corp., a reseller of consumer data, notified it of suspicious transactions made using the Wells Fargo access codes, a spokeswoman for the San Francisco-based bank said Monday. The codes are used by Wells Fargo employees to gain access to consumer credit data.

She said the records belonged to "random individuals," only a small number of whom are Wells Fargo customers.

"There is a full investigation underway to find out who is behind this," the spokeswoman said. Investigators have not yet determined how the Wells Fargo access credentials were illegally obtained or by whom, she added.

The compromise was first reported by The Breach Blog, which posted a link to a July 31 letter sent by Wells Fargo to New Hampshire Attorney General Kelly Ayotte notifying her that nine state residents were affected by the breach.

In the letter, Peter McCorkell, Wells Fargo's senior company counsel, said that the investigation has confirmed that "a significant number of unauthorized transactions had been made using Wells Fargo's codes." He said that Social Security numbers, birth dates, addresses, driver's license numbers and in some cases, credit account information, were illegally accessed.

McCorkell told Ayotte that the bank lacks contact information for all but about 2,400 of the affected individuals. The bank is in the process of finding addresses for the others, it added.

In a letter sent to the victims whose addresses were available, Sherry Courtney a senior vice president at the bank, disclosed the compromise and offered them a year's subscription to credit monitoring services. A copy of the letter was also sent to Ayotte.

The latest incident continues a string of embarrassing data compromises at Wells Fargo over the past few years almost all of them involving lost or stolen computers.

In Sept. 2006, the company notified an undisclosed number of employees that personal data was stored on a computer and hard disk stolen from a locked car belonging to an employee of a third-party auditing firm. Just four months earlier, Wells Fargo ha d disclosed on its Web site that? another lost computer contained personal data on an undisclosed number of mortgage customers and prospective clients. The system was reported lost in transit by a third-party firm that was transporting it from one Wells Fargo facility to another.

In February 2004, a laptop containing confidential information on more than 35,000 Wells Fargo customers was stolen from an employee's car parked at a gas station.

Read more about identity theft prevention in CSOonline's Identity Theft Prevention section.

• Print

• How To Protect Your Mobile Data
• Data Breach Fallout: Do CISOs Need Legal Protection?
• CSO Disclosure Series | Data Breach Notification Laws, State By State