var json_comments = new Array("
\"user-pic\"
Saboth
November 23, 2009 5:31 PM
Moderate | Flag for review

Heh, the default action for these guys is always \"one year of credit monitoring\". Guess that's fine, unless someone decides to steal your identity in 13 months.

Reply
5 replies
\"user-pic\"
PsiCop
November 23, 2009 5:31 PM
Moderate |Flag for review

@Saboth: That's why CT AG Blumenthal usually advocates for two years of credit monitoring, rather than 1, when these things happen in CT. (Such as in this recent debacle — in which not only personal financial data was lost, but so too was medical information on patients). I'm not sure why the 2 year barrier seems to be important ... perhaps someone has run the numbers to show it, perhaps not ... but the assumption is that once this kind of data has gone over two years old, it's too aged to be useful.

Reply
\"user-pic\"
SacraBos
November 23, 2009 5:31 PM
Moderate |Flag for review

@Saboth: I have email addresses that have never ever existed - but have been submitted to \"remove lists\". They get spam delivered to them every single day as that address is sold, bought, and abuse continuously.

Why do people think SSN's would be any different? They should be required to offer you credit monitoring for the rest of your life or pay all costs related to having your SSN changed.

Reply
\"user-pic\"
MauriceCallidice
November 23, 2009 5:31 PM
Moderate |Flag for review

@SacraBos: \"I have email addresses that have never ever existed ... They get spam delivered to them every single day as that address is sold, bought, and abuse continuously.\"

How does spam get \"delivered\" to a nonexistent address?

How would you know?

Reply
\"user-pic\"
neekap
November 23, 2009 5:31 PM
Moderate |Flag for review

@Saboth: I was going to say the exact same thing. You'd think if someone were to maliciously intercept this information that they would wait and see what course of action is being taken and work around it, like waiting 13 months in this case.

Reply
\"user-pic\"
DaveDidNotPay
November 23, 2009 5:31 PM
Moderate |Flag for review

@neekap: Or perhaps add it to a list and attempt to use it over and over again for decades to come.

Reply
\"user-pic\"
holytrainwreck
November 23, 2009 5:31 PM
Moderate |Flag for review

@David: And if such lists are bought and sold in big bundles they'll be a hot commodity as they age. Even if people have bad credit now, in seven years they won't.


The running joke with me is go ahead, steal my identity since I can't get credit anyway with a score of 525. But as time heals all wounds in the FICO scoring system, ten years from now it's quite possible to be back up in the high 700s or so.

Reply
","
\"user-pic\"
zarex42
November 23, 2009 5:31 PM
Moderate |Flag for review

It's pretty dumb, but the primary problem isn't that SSN's are shared - it's that something so easy to acquire as an SSN is used for anything requiring security. That really needs to stop.

Reply
4 replies
\"user-pic\"
holytrainwreck
November 23, 2009 5:31 PM
Moderate |Flag for review

@zarex42: In Canada, the equivalent Social Insurance Number (SIN) is supposed to be sacrosanct and used only for tax purposes and identification with the feds.


Once one abuse was allowed, i.e. for credit file identification, then everybody and their mother asks for it for ID even when they're not supposed to ask for it. You can refuse to give it out but then you're refused the service or benefit you're trying to apply for.


So, as is human nature, people take the lazy course of least resistance and give it out, leading to further abuses.

Reply
\"user-pic\"
hotdogsunrise
November 23, 2009 5:31 PM
Moderate |Flag for review

@zarex42: This.


And I hate it when companies refuse to let you use their service unless you give them your SSN. Unreal.

Reply
\"user-pic\"
Megladon
November 23, 2009 5:31 PM
Moderate |Flag for review

@hotdogsunrise:


Like my dentist... I told them, i'm paying you with a check, you know where I live, having my ssn wont help you if the above fails. I told them i wasnt giving them my ssn or signing the manditory arbitration. They still saw me, check cleared, all is good.

Reply
\"user-pic\"
Loias calls you out if you can't RTFA
November 23, 2009 5:31 PM
Moderate |Flag for review

@zarex42: I agree. It's such a contradiction that your SSN is supposed to be treated like the Arc of the Covenent and yet every company and their mother asks for part or all of your SSN. What it is: high confidential or a good idea for a personalized license plate?

Reply
","
\"user-pic\"
lehrdude
November 23, 2009 5:31 PM
Moderate |Flag for review

Why would UAG give 80,000 SS numbers to a \"Mailing Vendor\" in the first place? Were they going to withhold Federal Income Tax on postage or something?

Reply
6 replies
\"user-pic\"
Strangel76
November 23, 2009 5:32 PM
Moderate |Flag for review

@lehrdude: I have to agree with this. Why was it necessary to share this data with the mailer vendor? Seems like it shouldn't have been. It's convenient to blame the vendor, but if UAG doesn't share the info (which wasn't relevant to the print job), then this doesn't happen. I hope they review their own policies, and don't exclusively shove the blame to the vendor.

Reply
\"user-pic\"
ColoradoShark
November 23, 2009 5:31 PM
Moderate |Flag for review

@lehrdude: Yes, that was weasely of the insurance company to blame their mailing vendor. The mailing vendor can't make that mistake if you don't send them the info.

Right in line with the typical \"need to know\" policy. If you don't need to know, then you shouldn't get the information.

Right in line with the idea that it is easy to keep a secret you don't know about.

Reply
\"user-pic\"
floraposte
November 23, 2009 5:31 PM
Moderate |Flag for review

@lehrdude: Good question. My guess is that they just send them the recipient data without weeding it.

Reply
\"user-pic\"
tripnman
November 23, 2009 5:31 PM
Moderate |Flag for review

@floraposte: Yes, you'd be surprised how often that happens. My company mails 100's of thousands of pieces a month for our clients and we have very strict data handling procedures in-house (who can see the data, how quickly it is deleted from our systems after job completion, etc.). It's our clients that cause the problem by sending us database files that include SSNs, account numbers, balances, phone numbers, e-mail addresses, membership expiration dates, so on. It never fails - people, please - if you are sending out a simplified mailing provide your mailer with ONLY the data they need - name and full address.

Reply
","","
\"user-pic\"
GreatWhiteNorth
November 23, 2009 5:31 PM
Moderate |Flag for review

Hang on a company that specialized in being a \"Mailer\" made this error!


Isn't knowing what is and isn't acceptable part of the service a company like this is offering clients?


Wow, talk about a business killing screw up.

Reply
2 replies
\"user-pic\"
scoosdad
November 23, 2009 5:31 PM
Moderate |Flag for review

@GreatWhiteNorth: Not to defend what happened, but if UAG gave the mailer a mailing list that had a name and address with what may have appeared to be a random account number above the mail-to name, how are they supposed to know if the numbers were SSN's or not?

I get mailings from magazines I subscribe to all the time and my account number is part of the address on the mailing.

I point the blame for this directly at UAG. As lehrdude says above, why would they have knowingly given the mailer the SSN's as part of the mailing list in the first place? The firing of the mailer was, I think, just for show-- they're \"taking it seriously\".

Reply
\"user-pic\"
tripnman
November 23, 2009 5:31 PM
Moderate |Flag for review

@scoosdad: Agreed. The problem started with UAG providing the mailer with the SSNs as part of the mailing database. This is a major data security error on their part. Assuming that there were multiple levels of approval by UAG before the mailing went out, the final approval to proceed was theirs. The mailer is being made a scapegoat.

Reply
","","","
\"user-pic\"
Thumbmaster
November 23, 2009 5:31 PM
Moderate |Flag for review

Every time something like this happens, the offending company would offer a free one-year credit monitoring service. I bet there's a huge spike in identity theft cases about 13 months after each incident.

Reply
","","
\"user-pic\"
DoctorMD
November 23, 2009 5:31 PM
Moderate |Flag for review

Franklin Roosevelt promised the SSN would not become a personal serial number, it would only be used for collection and disbursement of SS funds. But once again (just like income tax capped at 1% for average people) the government lies. And we all get to suffer.

Reply
3 replies
\"user-pic\"
holytrainwreck
November 23, 2009 5:31 PM
Moderate |Flag for review

@DoctorMD: And the sheople allow the government to GET AWAY with these lies. It's insidious.

Reply
\"user-pic\"
PsiCop
November 23, 2009 5:31 PM
Moderate |Flag for review

@DoctorMD: The problem is FDR died in 1945 and obviously could do nothing to prevent it being used that way, after then.

Reply
\"user-pic\"
Joewithay
November 23, 2009 5:31 PM
Moderate |Flag for review

@DoctorMD: That was like 80 years ago when he said that. He obviously couldn't have the hindsight about modern information age. SSN just sort of evolved to an US ID number which I agree is stupid.

Reply
","","
\"user-pic\"
Blueskylaw
November 23, 2009 5:31 PM
Moderate |Flag for review

One year of credit monitoring is only that, monitoring.


Will they pay for the months of time, postage, telephone, lawyers and other expenses it can take to \"fix\" one's credit because of this colossal blunder?

Reply
1 replies
\"user-pic\"
starrion
November 23, 2009 5:31 PM
Moderate |Flag for review

@Blueskylaw:


No. That is why there are flocks of lawyers circling the UAI HQ today. If people start getting ID thefted, then that is when the Class action Lawsuit starts.


Of course if any of the 80,000 people get ID theft from a different origin, it will be up to UAI to prove it wasn't them.....

Reply
","","","
\"user-pic\"
Veeber
November 23, 2009 5:31 PM
Moderate |Flag for review

Watch out, the apology letter will probably have the SSN printed in the window too.

Reply
","","","
\"user-pic\"
Borax-Johnson
November 23, 2009 5:31 PM
Moderate |Flag for review

Roosevelt is dead. Its the newer guys' fault

Reply
","","","
\"user-pic\"
PLATTWORX
November 23, 2009 5:31 PM
Moderate |Flag for review

\"We at the UAM Action Network sincerely apologize for this error, which was made by our mailing vendor without our knowledge.\"


You did not monitor the content of your own mailings? You had no knowledge of what was being mailed and how it was being mailed? NICE ADMISSION!


Also, saying to customers that \"The vendor has been fired.\" is horribly unprofessional to put in a letter. How about the marketing employess of UAM Action Network that were involved in hiring this vendor and working on the mailing? Have they also been dismissed as they should have been?


I think more than a year of credit monitoring is in order here. Don't you?

Reply
2 replies
\"user-pic\"
HyperHacker
November 23, 2009 5:32 PM
Moderate |Flag for review

@PLATTWORX: Notice how big mistakes like this are always the fault of a vendor or other third party?

Reply
\"user-pic\"
PsiCop
November 23, 2009 5:31 PM
Moderate |Flag for review

@PLATTWORX: You're right. I don't buy that this project wasn't proofed by UAM. Either it was and they let it go anyway, thus demonstrating incompetence; or they didn't proof it at all, which is incompetence right off the bat. Either way, they cannot evade their complicity in this.

Reply
","","","","","","","","","
\"user-pic\"
theblackdog
November 23, 2009 5:31 PM
Moderate |Flag for review

Why the hell isn't Medicare Advantage using a random number instead of an SS#?!

Reply
","
\"user-pic\"
Elcheecho
November 23, 2009 5:31 PM
Moderate |Flag for review

how about perpetual credit monitoring?

Reply
","
\"user-pic\"
kexline
November 23, 2009 5:31 PM
Moderate |Flag for review

Dear UAM,

Why did you provide the vendor that information in the first place? There's no reason to expose all the information you have on all your customers to anyone who doesn't need it.

It's called a \"view\", or something inane like \"query\" if you're using SQL Server. Ask your DBA. If he doesn't know what you're talking about, get a new DBA.

Love,
Kexline

Reply
","
\"user-pic\"
Optimistic Prime
November 23, 2009 5:31 PM
Moderate |Flag for review

This is one of the problems with the medical industry as a whole. Many companies still use your SS# as an ID#. Think about it, just about every medical form you've ever filled out probably has your social on it.

One other mailer to really worry about is specimen packaging. Often times the specimen goes into a clear mailer, paperwork and all. The problem is the minimum wage worker packaging it puts all your info facing out so anybody who touches that package can get names, addresses, social, phone, and D.O.B.. Once you give your information to anybody, it's no longer secure.

Reply
1 replies
\"user-pic\"
SadSam
November 23, 2009 5:31 PM
Moderate |Flag for review

@Optimistic Prime:


And most people give their SS# when they fill out that form at the doctor's office. You don't need to hand over your SS# and I don't, the only number they need is my insurance company member number.


Just leave it blank and when they ask for it ask why they need it and be prepared to point out that they don't need it.

Reply
","
\"user-pic\"
stlbud
November 23, 2009 5:31 PM
Moderate |Flag for review

Why was UAM giving Social Security numbers to their bulk mailing vendor?


I appreciate their efforts to fix this but it shouldn't have happened in the first place.


Bill B.

Reply
","
\"user-pic\"
thisistobehelpful
November 23, 2009 5:31 PM
Moderate |Flag for review

My bank recently had a security breach apparently with the card issuer for my debit cards. I got sent a new card and went to the bank to ask why as I hadn't been notified I was getting a new card and hadn't requested one. Enclosed was a letter telling me that the card had been returned and resent to the po box provided by my post office. No one contacted me about receiving an alternate address they just automatically forwarded the card to an address that they were never given by me. All of my previous statements and bank mail had made it successfully to my street address.

When I went to the bank I was told that I should've received a letter informing me of the security breach BEFORE I got the new card. I have yet to receive that letter. There was a form enclosed with the card asking for change of address information despite the fact it was clearly addressed to my po box. When I asked a bank representative how they'd actually know it was me who changed the address if they forwarded it without asking me first they said because I'd have to sign the form. As if I'm going to believe that a bank with millions of customers is going to signature check an address form after failing to notify me of a breach in the first place.

I hate digital security.

Reply
","
\"user-pic\"
maruawe42
November 23, 2009 5:31 PM
Moderate |Flag for review

why would the insurance company let the mailing vendor have the medicare numbers anyway This was an oversight by the insurance company in the first place. I have prepared such list and the only information available to the vendor is the name,address, city, state ,zip and the verbiage for the mailer to customers........they must be using Microsoft office to prepare these list....or
a very uninformed person to prepare such list .

Reply
","","","","","","");