International Business Machines Corp. (IBM) and Iron Mountain Inc. (IRM) lost track of storage devices with data from the California Department of Child Support Services involving more than 800,000 people, the state said.
The information included names, addresses, Social Security numbers, drivers’ license numbers, heath-insurance providers and other data, California said today in a statement. The state said it learned of the missing storage devices on March 12.
The loss or theft of computers and storage devices is a common way data breaches happen. Since 2005, there have been 837 breaches affecting almost 169 million records involving lost, discarded or stolen laptops, smartphones and various portable data-storage devices, according to a database of publicly disclosed breaches maintained by Privacy Rights Clearinghouse.
Four backup tapes were discovered missing after being transported from an IBM facility in Colorado to California following a routine disaster-recovery exercise, according to Christine Lally, assistant secretary for legislation and communications with the California Technology Agency. The tapes are believed to have fallen out of an improperly secured shipping container while in transit, she said in an interview.
“Because the devices are in a specialized format, we have no reason to believe, at this time, that the data have been accessed or utilized in any way,” Kathleen Hrepich, interim director of California’s Department of Child Support Services, said in the statement. “Additionally, this incident will have no impact on the processing of child support cases.”
Jeff Tieszen, a spokesman for Armonk, New York-based IBM, didn’t immediately respond to a request for comment. Christian Potts, a spokesman for Boston-based Iron Mountain, did not immediately return an after-hours call and e-mail.
California has set up a website with more information about the breach and recommendations for setting up fraud alerts and other protective measures.
To contact the editor responsible for this story: Tom Giles at firstname.lastname@example.org