Fidelity admits theft of data on 2.3m customers

Fidelity National Information Services has admitted that personal information on 2.3 million people has been illegally removed from its database.

The breach occurred at Certegy Check Services, a company that handles cheque and credit card monitoring for merchants and casinos. 

Fidelity stressed that no computer systems were compromised in the data theft. The information was collected and transported by a database administrator who was placed in charge of data access privileges.

The employee also ran a data brokering business, and the stolen information, which included addresses, phone numbers, dates of birth, and in some cases credit card and bank account numbers, was then sold off to marketers.

According to Fidelity, the breach was not discovered until a retailer contacted Certegy to complain that several customers had been receiving phone calls and mail from solicitors.

Unable to find any record of an electronic breach in its network, Certegy called the US Secret Service which traced the data back to a brokerage company run by the employee.

Certegy maintains that no cases of fraud or identity theft have been reported in connection to the breach.

Of the 2.3 million records compromised, 99,000 contained credit card information, while the remainder contained bank account information.

The company plans to alert all affected customers and assist banks in placing fraud alerts on the compromised accounts.

Certegy is also vowing to pursue legal action against the employee and the marketers that purchased the stolen data.

Beth Givens, director of consumer watchdog group Privacy Rights Clearinghouse, described the breach as "horrendous". 

"The facts do not paint a good picture of Certegy," Givens told vnunet.com. 

"Any company that holds sensitive personal information should have an electronic audit trail and flagging system so that key people can be notified when sensitive data is accessed."

Privacy Rights Clearinghouse said that the Certegy incident is the third largest data breach this year. In April, a disk was lost containing information on 2.9 million people went mission from the Georgia Department of Community Health.

In January, criminals stole more than 45 million credit and debit card numbers from retail chain TJ Maxx in the largest personal data breach ever recorded.