Personal data on 17,000 Pfizer employees exposed; P2P app blamed
An employee had installed file-sharing software on a company laptop
Computerworld - A Pfizer Inc. employee who installed unauthorized file-sharing software on a company laptop provided for use at her home has exposed the Social Security numbers and other personal data belonging to about 17,000 current and former employees at the drug maker.
Of that group, about 15,700 people actually had their data accessed and copied by an unknown number of persons on a peer-to-peer network, the company said in letters sent to affected employees and to state attorneys general alerting them of the breach.
Pfizer officials could not be immediately reached for comment. But copies of the letters were posted on several sites, including Pharmalot, a blog covering the pharmaceutical industry.
The incident has prompted an investigation by Connecticut Attorney General Richard Blumenthal; some 305 Pfizer employees in that state were affected by the breach. In a June 6 letter (download PDF), Blumenthal asked Pfizer to provide details on the measures in place prior to the breach to protect against data compromises, as well as information about when the company discovered the breach and how it responded.
Blumenthal's letter also asked Pfizer to describe how it was able to make a distinction between the data that was actually compromised and data that might only potentially have been accessed. Blumenthal's letter gave Pfizer until June 22 to respond.
According to Pfizer's description of the incident in its letter to employees, the compromise stemmed from the use of unauthorized file-sharing software on an employee's laptop.
The June 1 letter signed by Pfizer General Counsel Lisa Goldman did not mention how the company discovered the breach. But she said that as soon as the company did become aware of the breach, it recovered the laptop from the employee and the file-sharing software was disabled. Because the system was being used to access the Internet from outside of Pfizer's own network, no other data was compromised. Goldman also apologized to the affected individuals for the inconvenience.
Pfizer has contracted for a "support and protection" package with credit reporting agency Experian for all affected persons, Goldman said. The packages include a year's worth of free credit monitoring service and a $25,000 insurance policy covering costs that individuals might incur as a result of the breach, Goldman noted.
Such incidents highlight the importance of implementing controls for preventing either accidental or deliberate data leaks via file-sharing tools or applications such as instant messaging systems, said Devin Redmond, director of the security products group at security vendor Websense Inc. Such controls should include measures such as content filtering at network gateways, strong controls on access to sensitive data and prevention of access to file-sharing applications, he said.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts