230 retailers affected by data breach after tape lost

IDG News Service - A backup tape containing credit card information from hundreds of U.S. retailers is missing, forcing the company responsible for the data to warn customers that they may become the targets of data fraud.

GE Money USA, which manages in-store credit programs for many U.S. retailers, first realized that the tape was missing from an Iron Mountain Inc. storage facility in October, said Richard Jones, a company spokesman. "We were informed that one of the tapes could not be located. But at the same time, there was no record of it ever having been checked out," he said.

The tape contained in-store credit card information on 650,000 retail customers, including those of J.C. Penney Co., he said. GE Money employees were also affected by the breach.

The missing backup tape was unencrypted.

Although J.C. Penney was the only company that Jones would confirm as affected by the missing tape, that retailer accounts for just a small percentage of all accounts that were compromised. In total, 230 retailers are affected by the breach. "Clearly, that number includes many of the national retail organizations," he said.

The tape also contained Social Security numbers of 150,000 customers. When matched with name and address information, Social Security numbers can be used to set up fraudulent credit card accounts, a common form of identity theft.

Jones said that following a GE Money investigation, there is no evidence that the tape in question has been stolen or that the data it contained was misused.

After reconstructing the data that was on the missing tape, GE Money began sending out letters to those affected by the breach in December. The company has set up a toll-free number and is offering one year of free credit-monitoring services to those affected by the breach.

In 2006, retailer The TJX Companies Inc. discovered that thieves had broken into its computer networks, stealing an estimated 94 million credit and debit card numbers. Costs related to that breach are expected to be in the hundreds of millions of dollars.

GE Money is a division of General Electric Co.

Reprinted with permission from

IDG.net
Story copyright 2009 International Data Group. All rights reserved.