Rob Douglas' column appears Fridays in the Steamboat Today. He can be reached at rdouglas@SteamboatToday.com.
Find more columns by Douglas here.
Steamboat Springs Because of the theft of a laptop containing the Social Security numbers of 1,300 past and present Steamboat Springs School District employees this week, I'm changing hats from columnist to identity theft consultant.
As readers may recall, when not sharing my opinions on issues impacting the Yampa Valley, I work as an information security consultant and editor of an identity theft Web site. Under that fedora, I'll offer the same advice I provide individuals, corporations and governments across the country when they experience breaches of sensitive information similar to what happened to the school district.
Although it is unlikely the stolen laptop will result in financial fraud, the school district and employees should respond with an eye toward the worst-case scenario. And, even if you aren't a school employee, you may want to read on. Statistically, each of us has our personal or financial information stolen each year - there are more than 300 million records exposed per year in reported data breaches. For that reason, we all should know how to guard against identity theft.
Social Security numbers are the keys to the kingdom of financial fraud. There are more than 15 million victims of identity theft in the U.S. every year, resulting in more than $50 billion in financial harm. Identity theft is the fastest-growing crime in America, and it shows no sign of abating.
In light of the stolen Social Security numbers, the school district and jeopardized employees should consider the following:
- The district should personally notify by mail every individual whose Social Security number was stolen. Although this may be a difficult task in that many past employees may have moved out of the valley, the district should make every attempt to notify them about the stolen information.
- The district should provide at least one year of credit monitoring for all employees placed at risk. The provision of credit monitoring is the standard remedy in data breach cases across the country, and the school district should meet the standard. An appropriate credit monitoring service will notify employees if there is suspicious activity on their credit bureau file and may be able to assist in locating employees who've moved.
- The district should re-evaluate its information security procedures. Maintaining unencrypted sensitive information on a laptop is cause for dismissal at many businesses and government agencies across the country. While dismissal in this case is unwarranted, further inappropriate information security actions should be subject to discipline.
On Thursday afternoon, district Superintendent Shalee Cunningham called me, and we discussed the above recommendations. Cunningham assured me that she will consider implementing the suggestions. The superintendent has been proactive in addressing this security breach from the outset, so hopefully she will follow through and take all three steps to appropriately protect her employees.
- Place a security freeze on your credit report with each of the three major credit bureaus - Equifax, Experian and TransUnion. Although there is no fool-proof tool to prevent identity theft, a security freeze is the best way to stop a thief from opening a credit line in your name. Information for Colorado residents about security freezes can be found here.
- If you decide against a security freeze, place a fraud alert on your credit report. A fraud alert will notify creditors to take extra authentication steps before opening a new credit line in your name. Equifax has a user-friendly procedure and once you place the alert, Equifax will notify Experian and TransUnion to do the same.
- In addition to taking advantage of the credit monitoring service the school district hopefully will supply, you can obtain free copies of your credit report at www.annualcreditreport.com. You're entitled to one free copy of your credit report from each of the three major bureaus each year. By staggering your requests, you can obtain a free credit report every four months.
- You can find more information about protecting yourself against identity theft than I have space to provide within this column by going to my Web site, www.InsideIDTheft.info. The site provides free information about all aspects of identity theft and contains numerous other resources to aid in combating identity theft.
Finally, any school employee at risk because of the stolen laptop should feel free to contact me if you have any questions. I can be reached at Rob@InsideIDTheft.info.