In Focus: FDIC Data Breaches Were Accidental

Two former employees took home thousands of sensitive files, none of which were compromised

By Aliah D. Wright Apr 22, 2016
LIKE SAVE PRINT
Reuse Permissions

​​​

Two data breaches within six months of each other by employees on their last day of work at the Federal Deposit Insurance Corp (FDIC) highlight the need for more security awareness training, experts tell SHRM Online.

In both cases, employees downloaded sensitive information as they were leaving jobs with the FDIC. None of the information was compromised, the agency said.

Created by Congress in 1933, the FDIC is an independent government corporation whose sole purpose is to maintain public confidence and stability in the nation’s financial system. It insures individual deposits of up to $250,000.

Maintaining public confidence is hard to do when an employee can walk away with supposedly secure customer data apparently without even knowing it,” The Washington Post opined.

Some 44,000 FDIC customers had their information exposed in February when an employee quit the agency and accidentally carried customer names, Social Security numbers and addresses out on a personal storage device that also included her personal information, according to news reports.

“Security is as much a cultural issue as a technical one,” David Meyer, vice president of products and online business at OneLogin, an access management firm based in San Francisco told SHRM Online April 21. He added that “the security posture day to day among the employees is the largest battle.”

In a separate incident at the FDIC in October, another FDIC employee left the agency for a job in the private sector and took with her on a thumb drive 10,0000 records containing highly sensitive information. That information included Social Security numbers and loan and banking information for American citizens, according to a Feb. 19 report from FDIC Assistant Inspector General for Audits Mark Mulholland. It was information she had access to as part of her job.
(
Federal Times and the Washington Post)

According to a recent study by Intel Security, a computer security software company based in Santa Clara, 43 percent of data loss from organizations can be attributed to employees taking information by accident. In the FDIC case in February, the former employee accidentally downloaded the information on Feb. 26 “without malicious intent,” the agency stated in an internal memo obtained by the Post. As she was downloading her personal family photos and resume from her work computer onto a USB drive to take with her, she accidentally also downloaded 44,000 customer records. 

“The FDIC’s data loss protection software detected the compromise of records and alerted security staff. The FDIC contacted the ex-employee immediately and asked her to return the drive; the agency had it back by March 1,” American Banker reported.
(American Banker and SC Magazine)

Whether an employee haphazardly clicks on a link that exposes organizations to viruses or takes sensitive data home on a laptop that gets stolen or purposely hacks into sensitive files for personal financial gain, HR professionals need to guard against workers’ ability to compromise important data.
(SHRM Online)

Having technology in place to detect untoward activity is smart, but while “technology is critical … you should eliminate passwords in applications, use multiple authentication factors, and analyze behavior. Yet, the attitude employees have can circumvent all of that. HR needs to partner with IT to ensure the workplace facilitates security,” Meyer said.

There are other things HR can do, too.

“One of our customers has a policy of looking over all activities for the past 90 days when an employee resigns,” Meyer said. “This is because the intention to leave comes long before the resignation and with the intention to leave comes a risk of bad behavior.

“The better manager training, the better the trust in an organization, the better a sense of aligned values and common mission mitigate these factors.  If there is no ill will, then there will be fewer malicious acts.”

Meyer said HR and IT can also use “an identity system together with other tools [that] can monitor behavior to detect anomalies. When behavior patterns change it can be a sign of ill intent; downloads are one aspect, but what files or information are accessed online is much more common in this cloud-centric world.”

Aliah D. Wright is an online editor/manager for SHRM.

LIKE SAVE PRINT
Reuse Permissions

MEMBER BENEFITS

CA Resources at Your Fingertips

View all Resources Now

Job Finder

Find an HR Job Near You

SPONSOR OFFERS

Find the Right Vendor for Your HR Needs

SHRM’s HR Vendor Directory contains over 3,200 companies

Search & Connect