Ads by TechWords

See your link here
Receive the latest technology news and information.
Security
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
Cloud Computing
View all newsletters




Privacy Policy
 

Personal data on 17,000 Pfizer employees exposed; P2P app blamed

An employee had installed file-sharing software on a company laptop

June 12, 2007 12:00 PM ET

Computerworld - A Pfizer Inc. employee who installed unauthorized file-sharing software on a company laptop provided for use at her home has exposed the Social Security numbers and other personal data belonging to about 17,000 current and former employees at the drug maker.

Of that group, about 15,700 people actually had their data accessed and copied by an unknown number of persons on a peer-to-peer network, the company said in letters sent to affected employees and to state attorneys general alerting them of the breach.

Pfizer officials could not be immediately reached for comment. But copies of the letters were posted on several sites, including Pharmalot, a blog covering the pharmaceutical industry.

The incident has prompted an investigation by Connecticut Attorney General Richard Blumenthal; some 305 Pfizer employees in that state were affected by the breach. In a June 6 letter (download PDF), Blumenthal asked Pfizer to provide details on the measures in place prior to the breach to protect against data compromises, as well as information about when the company discovered the breach and how it responded.

Blumenthal's letter also asked Pfizer to describe how it was able to make a distinction between the data that was actually compromised and data that might only potentially have been accessed. Blumenthal's letter gave Pfizer until June 22 to respond.

According to Pfizer's description of the incident in its letter to employees, the compromise stemmed from the use of unauthorized file-sharing software on an employee's laptop.

The June 1 letter signed by Pfizer General Counsel Lisa Goldman did not mention how the company discovered the breach. But she said that as soon as the company did become aware of the breach, it recovered the laptop from the employee and the file-sharing software was disabled. Because the system was being used to access the Internet from outside of Pfizer's own network, no other data was compromised. Goldman also apologized to the affected individuals for the inconvenience.

Pfizer has contracted for a "support and protection" package with credit reporting agency Experian for all affected persons, Goldman said. The packages include a year's worth of free credit monitoring service and a $25,000 insurance policy covering costs that individuals might incur as a result of the breach, Goldman noted.

Such incidents highlight the importance of implementing controls for preventing either accidental or deliberate data leaks via file-sharing tools or applications such as instant messaging systems, said Devin Redmond, director of the security products group at security vendor Websense Inc. Such controls should include measures such as content filtering at network gateways, strong controls on access to sensitive data and prevention of access to file-sharing applications, he said.



Jump to comments

Pfizer

Additional Resources

Xerox
By using solid ink technology only from Xerox, you could save up to 65% by printing color for the cost of black and white. Enter for a chance to WIN a PhaserTM 8860 network color printer!
Microsoft
Save time and mitigate security risk. Deploy it now.
Sybase
In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

What People Are Saying

White Papers & Webcasts

Share our Strength
Download Now  

Managing Secure File Transfer to Save Time, Money and IT Resources
Learn how companies are using innovative technology to overcome these challenges and improve user productivity by offloading e-mail attachments and replacing FTP with...

Security Convergence Equals Network Security Cost Savings
Listen to IBM Internet Security Systems' take on network security convergence.

Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...