RadioShack may have tossed 'thousands' of customer records into Dumpster

Computerworld - RadioShack Corp. dumped "thousands" of customer records behind a store near Corpus Christi, exposing consumers to possible identity theft, the Texas attorney general charged late yesterday.

According to Attorney General Greg Abbott, the Fort Worth-based company violated multiple state statutes, including the Identity Theft Enforcement and Protection Act, a 2005 law that requires businesses to protect and properly dispose of customer personal information.

State investigators followed up on reports that workers at a Portland, Texas, RadioShack store dumped customer records and receipts in a Dumpster behind the store on or around March 21. Those records, said Abbott, contained Social Security numbers, credit and debit card information, names, addresses and telephone numbers of customers.

"Texans expect their personal information to be protected," said Abbott in a statement. "The Office of the Attorney General will take all necessary steps to ensure that consumers are protected from identity thieves."

RadioShack said that the dumping was a one-time incident. "Our Northshore Plaza store in Portland, Texas, is part of a shredding program we have in place throughout the state for the secure disposal and destruction of such documents," Steve Schmidt, a RadioShack area vice president, said in a statement. "The store did not act in accordance with this program. However, we moved quickly to reclaim and secure those documents.

"We fully intend to work amicably with the Texas Attorney General's office in reaching a resolution to the matter," Schmidt added.

Ironically, one receipt (PDF format) found in the trash was from an August 2005 store transaction in which a customer purchased a paper shredder. The receipt included the consumer’s name, address, telephone number, credit card account number and the expiration date for the card.

Under the state's identity theft law, RadioShack could face fines of up to $500 for each abandoned record.

Abbott has been in the national news of late regarding identity and privacy disputes -- not with businesses, but with other government officials. In February, Abbott ruled that Texas county and district court clerks were violating both state and federal privacy laws by posting Social Security numbers on their Web sites. Last week, however, Gov. Rick Perry signed a bill that allows the clerks to continue publishing the personal information.

Read more about security in Computerworld's Security Knowledge Center.