Blue Lance InfoSec Blog

Data Theft at Mitsubishi UFJ Securities Leads to Arrest of Manager

On Thursday, June 26, 2009, the former acting manager for Mitsubishi UFJ Securities Company was arrested by Tokyo police for data theft committed in February of this year.  Hideaki Kubo, 44, stole personal data on approximately 1.5 million customers and proceeded to sell some of their personal information to mailing list companies.  He was fired in April when news of his theft reached management at Mitsubishi.

Kubo has admitted to the allegations of theft and illegal data access.  He used the access credentials of a female contractor for the company to gain entry to the customer database and steal the information.  The contractor had been moved to a different department, but her access privileges had not yet been revoked for the customer information database.

After retrieving data on Mitsubishi’s entire client list, Kubo then copied the information to a server and burned it to a CD.  He took the CD home and used his personal computer to sell some of the data to mailing lists, collecting about 328,000 yen (about 3,407 USD).  Kubo, who violated the Law on the Prohibition of Unauthorized Computer Access, faces a maximum of one year in prison or a fine of up to 500,000 yen (about 5,194 USD).   He will also be charged with the theft of the 65-yen CD he stole from company supplies to which he copied the information.

Philips Lumileds Ex-Employee Sentenced for Stealing Trade Secrets

Robert Scott West was sentenced last week to 10 months home confinement, ordered to pay $100,000 in restitution to Philips Lumileds Lighting Company, and $5,000 in fines.

West, 21, of Morgan Hill, CA, pled guilty in federal court in San Jose on March 9^th to one count of Possession of Stolen Trade Secrets in violation of 18 U.S.C. § 1832( a )( 3 ).

In February 2008, several months after resigning from his position as a senior product manager at Philips Lumileds to work for a competitor, West was found in possession of the architecture and product specifications for Philips Lumileds’ next generation of Luxeon Rebel surface mountable power LEDs.  According to the plea agreement, West had downloaded and copied the information before resigning from Philips. He intended to use the information to benefit himself and harm Philips.

Before pleading guilty, West met with representatives from Philips Lumileds and the government, and agreed to assist in accounting for all the copies of the confidential and proprietary information that he had made.

Philips Lumileds Lighting Company is a San Jose, CA company that designs and manufactures light emitting diodes, which may be used for computer displays, liquid crystal display televisions and general lighting. One of the company’s primary products was the Luxeon Rebel line of LED’s.

The maximum statutory penalty for each count of possession of stolen trade secrets in violation of U.S.C. § 1832( a )( 3 ) is 10 years imprisonment, 3 years of supervised release, and a fine of $250,000

Hanley Chew is the Assistant U.S. Attorney who prosecuted the case with the assistance of Lauri Gomez. The prosecution is the result of an investigation by the Federal Bureau of Investigations. The investigation was overseen by the Computer Hacking and Intellectual Property Unit of the U.S. Attorney’s Office. Philips Lumileds cooperated with the investigation.

View the full press release

Update: MasterCard Responds to Questions About New Audit Requirements

A representative from MasterCard contacted Blue Lance today with the following response to our queries.  Chris Harrall, Senior Business Leader for MC’s Payment System Integrity Group responded with this Q & A:

Q: Is it accurate that MasterCard will require Tier 2 merchants to conduct annual on-site reviews of their security controls by third party QSAs?

A: The company announced revised requirements for Level 2 merchants to use a Qualified Security Assessor (QSA) to complete a mandatory annual onsite data security assessment by December 31, 2010.

Q: If so, when was the change made and why?

A: These changes were announced in the MasterCard Global Security Bulletin No. 6 published on June 15, 2009 and distributed directly to MasterCard acquirers and processors. The current enhancement of validation requirements for PCI compliance provides for independent third party review, enabling consistency of application and implementation of DSS requirements.

Q: How much time do Tier 2 merchants have to comply with the new requirement?

A: Level 2 merchants must use a Qualified Security Assessor (QSA) to complete a mandatory annual onsite data security assessment by December 31, 2010.

To view the post regarding this requirement change, click here.

Nevada Mandates PCI Standard

The state of Nevada is going all in.  By January 1, 2010, every payment card-accepting business in the state of Nevada will be required to comply with PCI DSS regulations.  Nevada is the first state to mandate PCI compliance, trumping Massachusetts, the former data security leader in the US (as far as laws are concerned).

This legislation is more of a statement than an actual change as far as companies accepting credit cards are concerned; all businesses accepting payment card transactions are already required to comply with PCI DSS regulations, and can be fined by PCI if regulations are not adhered to.  Conversely, the state of Nevada had made no remarks about penalties that would be incurred if their new PCI law is broken.

The group to be affected by this legislation most is companies dealing with non-credit card personal data, such as Social Security numbers, drivers’ license numbers, and account numbers in combination with passwords.  Encryption requirements are included in the new law for transfers of these types of personal information outside of a company’s control, though some form of those requirements existed prior to the new legislation.

View the legislation

MasterCard to Increase PCI Compliance Requirements for Level 2 Merchants

As of December 31^st, 2010, all merchants processing between one and six million MasterCard transactions annually will have to undergo a yearly on-site audit to confirm PCI compliance, according to the company’s Site Data Protection Program.  MasterCard has yet to reply to queries regarding the reasoning behind this decision.

Lee Pierce of Security Metrics, a third-party PCI DSS auditing company, speculates that the change was made due to the increasing number of high profile security compromises that have occurred lately.  Pierce expects an increase in call volume to Security Metrics and companies like it from the many Level 2 classified merchants who will now require their services.

This change will put a dent in the budgets of Level 2 merchants, who are presently only required to perform an annual self-assessment, but should ensure more comprehensive PCI DSS compliance.  It is unclear at this time if other credit card companies will follow suit.

MasterCard’s website still states that Level 2 merchants are required to self-assess.  It remains to be seen if this double requirement is apparent simply to ensure that some type of assessment is taking place until the date set for the onsite assessment change, or whether it will remain so to back up either party's compliance conclusions.

Insider Theft of Personal Data Increases in 2009 According to Report

A new report from the Identity Theft Resource Center indicates that insider theft of personal data increased from 15% to 18.4% during the first half of 2009.  The data is based upon the 250 data breaches reported by the ITRC as of June 15.

Malicious attacks, which the ITRC regards as breaches within their insider theft and hacking categories, make up 36% of all breaches reported this year.  The ITRC, who has been tracking breaches involving the loss personal information since 2005, also states that many breaches are caused by repeated events from the same organizations who "just don't get it".

According to the press release:

Breaches cost businesses and the government money, a direct hit to their reputation, and a possible loss of consumer trust.  For years, companies have said that it would cost more to make protective changes than to pay the price of a data breach.  That formula is dated, incorrect, and a risky business practice.  Breaches now have significant business cost attached to notification and mitigation.  The fact is that any company or agency implementing effective data protection will save money in the long-run.  More importantly, they will enhance trust with their customers and the public.

View the Reports from the ITRC

Charles Schwab Employee Loses Personal Information of 60 Customers

A Charles Schwab employee removed a hard drive containing the records of 60 clients, including social security numbers, names, and account numbers, from his New Hampshire office in early May of this year.  The hard drive was subsequently stolen, leaving all of that personal information in someone else’s hands.

The report filed to the Attorney General by Andrew Caspersen of Charles Schwab claims that there was no malicious intent behind the removal of the hard drive, but that the employee has been terminated for breaking company policy.

A police report was filed and an arrest has been made in connection with the theft of the hard drive, however the hard drive itself has not been recovered.  Meanwhile, Charles Schwab is monitoring the affected clients’ accounts and has offered them one year of free credit monitoring.

Insurance Company Employee Admits Identity Theft

Shanell Angelia Bowser, a former claims clerk for a medical claims adjuster, pleaded guilty to stealing the personal data of claimants and using the data to obtain credit.  According to the press release:

Over the course of the three year scheme, Bowser and her co-schemers used stolen identifying information of at least 207 individuals in at least 373 applications for credit accounts from financial institutions. Of those applications, at least 125 fraudulent accounts were opened and used to make purchases in the names of 89 individual victims. At least $174,000 in retail goods and cash advances were purchased and obtained using the fraudulently opened credit accounts.

 Bowser faces a maximum sentence of 30 years in prison and a $1 million fine for conspiracy to commit bank fraud; and a mandatory sentence of two years in prison for aggravated identity theft, consecutive to any term of imprisonment for the conspiracy.

Read the full press release

Insider Reportedly Arrested in Sony Card Data Theft

Databreaches.net reports that Sony discovered a breach in May where credit card data obtained through the Sony Rewards web site had copied and in some cases, emailed to an outside account.  The data included credit card numbers, names and expiration dates.

After an investigation, a suspect was arrested within Sony's Park Ridge offices.  Sony has sent notices to approximately 5000 customers.

Read the full story

Terminated Employee Disrupts Texas Power Company Operations

Wired.com reported on May 29th that a former employee of Energy Future Holdings, a Dallas-based energy corporation that operates the Comanche Peak nuclear power plant, allegedly logged on to the corporate network after his termination and emailed, modified, and deleted files containing proprietary information, resulting in an estimated $26,000 loss for the company.

According to the article,

“No charges have apparently been filed, but the FBI is treating the case as a suspected violation of federal computer crime laws, including a rarely-used statute prohibiting breaking into a computer and creating ‘a threat to public health or safety.’

“But the damage noted in the affidavit appears to be purely financial. One of the files that was tampered with, ‘Hourly Capacity Supplied — 2009 upload.xls,’ is described as an ‘input file to determine the power generation required by the RFH system components.’ The net result of the tampering was that ‘the EFH management system was rendered inoperable, resulting in EFH being unable to accurately forecast the parameters necessary to operate the business on March 4, 2009.’”

The ex-employee, Dong Chul Shin, had access to more than just the file system:

While at EFH, Smith notes, “Shin was responsible for programming the models which controlled the management of EFH power generation facilities, including Comanche Peak.”

Hopefully, the FBI investigation will provide enough evidence to result in a charge against the individual responsible, but the underlying issue here is why employees continue to have access to critical assets after their termination. 

This is a common theme in recent insider theft and sabotage cases that should serve as a warning to all organizations to review their termination policies.  The termination of one or more employees requires a coordinated effort between departments to ensure the removal of physical and electronic access to organizational assets.  It makes no sense to terminate an employee, escort him/her from the building only to leave VPN access and login credentials intact. 

At best, it's a costly oversight but nonetheless, it is a process failure and requires an internal review of termination procedures at EFH. 

And while they're at it, they can consider themselves lucky this wasn't worse.

Read the entire article here.