Vulnerabilities / Threats

3/30/2011
12:14 PM
50%
50%

BP Loses Laptop With Gulf Claimant Data

The missing computer, containing personally identifiable information on 13,000 people, was password-protected, but not encrypted.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
A BP laptop containing personally identifiable information for approximately 13,000 people is missing. All of the people listed on the computer's hard drive had claimed damages due to the oil spill resulting from the Deepwater Horizon accident.

The laptop, which was lost by a BP employee last month during business-related travel, was password-protected, but not encrypted. A spreadsheet on the laptop -- used for tracking claimants prior to the Gulf Coast Claims Facility being established -- contained people's names, addresses, phone numbers, dates of birth, and social security numbers.

"The lost laptop was immediately reported to law enforcement authorities and BP security, but has not been located despite a thorough search," said Robert Wine, a press officer for BP, via email.

So far, the information appears simply to have been lost, rather than stolen. "There is no evidence that the laptop or data was targeted or that anyone's personal data has in fact been compromised or accessed in any way," he said. "Our security team continues to monitor the situation very closely and we are still in touch with authorities in an attempt to recover the laptop.

"BP takes the protection of personal information very seriously and deeply regrets the loss of the laptop," he said.

BP is sending letters to everyone who's been affected, and offering free credit monitoring services to alert people if their details are used by identity thieves.

According to a 2010 study from the Ponemon Institute, surveyed organizations lost an average of 261 laptops per year, with the lost data on each costing an average of $49,246. The study also found that any given laptop, over a three-year period, has a 5% to 10% chance of being lost or stolen, and only 5% of those missing will ever be recovered.

Hence it's surprising that so few organizations use full-disk encryption to secure laptops against loss or theft, said Paul Ducklin, head of technology in Asia Pacific for Sophos, in a blog post.

"Even if you're the sort of organization which is willing to take risks with your own data -- sales forecasts, trade secrets, and that sort of thing -- you have a clear moral duty not to take risks with data you keep about other people," he said.

"Unfortunately, in those parts of the world where encryption and mandatory disclosure are not enforced by law, many sysdamins are being squeezed by budgetary pressures to do as little as possible about encryption-related security," he said.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
3 Ways to Retain Security Operations Staff
Oliver Rochford, Vice President of Security Evangelism at DFLabs,  11/20/2017
A Call for Greater Regulation of Digital Currencies
Kelly Sheridan, Associate Editor, Dark Reading,  11/21/2017
New OWASP Top 10 List Includes Three New Web Vulns
Jai Vijayan, Freelance writer,  11/21/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Managing Cyber-Risk
An online breach could have a huge impact on your organization. Here are some strategies for measuring and managing that risk.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.