Imation Lab Tests Reveal Data Leak Risks

Imation Corp. has announced that it has uncovered data leak risks and other serious security and financial risks in data centers because improper destruction of used data storage products. Patient health records, Social Security numbers, bank account numbers and internal auditing procedures are examples of the kinds of information that is quietly leaking out of data centers. This disturbing trend is the result of companies improperly disposing of used data storage products at end of life, including a growing practice of selling used computer tape cartridges to so-called recertifiers.

"All used data storage products, whether optical discs, flash, hard drives or tape media, must be properly retired and disposed of in order to protect against possible data leaks," said Subodh Kulkarni, vice president of global commercial business, R&D and manufacturing at Imation. "Despite the data storage industry's warnings, companies continue to put themselves at risk. Imation wants to remind data centers that the only way to securely dispose of used tape media is through a reputable tape destruction service that provides a 'certificate of destruction. Tests in our lab of more than 100 commercially obtained tape cartridges confirmed that significant data 'leakage' is occurring as a result of the practice of 'recertifying' instead of properly destroying used tape. We take this issue seriously, because Imation's business is centered on security in data storage, and our products are being resold and reused in ways that can compromise a company's information."

Data leaks occur when data storage managers, who increasingly face budget constraints, sell or give tape cartridges containing company data to a reseller who claims to erase or destroy the data. The reseller often 'recertifies' the cartridges without fully erasing the data then sells them back into the market. In many cases, the data storage manager is unaware of this practice although these cartridges often contain confidential company and customer data. Imation, the world's largest supplier of magnetic data storage tape, has determined through its testing that many tape cartridges, especially those with magnetic servo tracks, can't in fact be completely wiped clean. With today's high-capacity cartridges, significant amounts of data may be left intact and exposed to unwanted breaches. A typical tape cartridge can store hundreds of gigabytes of data, with the most current high-end cartridges holding up to a terabyte. An estimated 1 million cartridges are recertified each year.

While the practice of reselling used tape was established to mitigate budget constraints, the costs associated with data breaches can far outweigh any savings. According to industry analysts and others who study the financial, security and reputational risks of data breaches, the cost to companies resulting from the failure to protect data is growing each year. A report from the Ponemon Institute ("2006 Annual Study: Cost of a Data Breach") found that the average cost to companies per lost customer record is $182. Multiply this by the thousands of individual records that may remain on improperly retired used data storage products, and the financial risk to these companies becomes apparent.

"Today's tape cartridges have storage capacities of 500GB or more. Even if 99.9% of data is erased from a tape, hundreds of megabytes of potentially sensitive data could remain on the tape. This could include thousands of customer names and Social Security numbers, which in turn expose a company to millions of dollars in legal fees, credit-monitoring costs and customer communications," Kulkarni said. "It could also ruin a company's reputation, result in significant customer desertions, and potentially expose it to regulatory penalties and costly lawsuits. Companies that sell used tape aren't selling back just one tape cartridge; they're selling hundreds at a time and, as a result, are unknowingly gambling with their customers' security and their entire businesses. The modest financial benefits from selling used tape are not being weighed against this potentially catastrophic consequence."

According to the Privacy Rights Clearinghouse, as of early October 2008, more than 245 million personal records have been exposed as the result of data breaches in the past three years alone, and that number is on the rise. In addition, the Ponemon Institute study found that more than 90% of data breaches occur in digital form, and the costs associated with data loss are rising into the billions of dollars each year.

Copyright © 2008 IDG Communications, Inc.

7 inconvenient truths about the hybrid work trend
Shop Tech Products at Amazon