Kudos to the School Department in Massachusetts
Another case of people handling a breach correctly, this one from Massachusetts. Megan Woolhouse reports in the Boston Globe:
A hard drive containing the names and Social Security numbers of more than 263 teachers, state employees, and consultants vanished from the School Department earlier this week, baffling officials.
An auditor at the Department of Education’s Malden headquarters arrived at work Tuesday to find his computer wasn’t working. Technical workers identified the problem: His hard drive was missing. Someone had taken it.
[...]The drive contained random audits done on payroll accounts, Guarino said. Officials initially thought it did not contain any Social Security numbers, but after reviewing thousands of backup files, they learned on Wednesday that more than 200 Social Security numbers and other business information had been compromised, she said.
Comment: from discovery of stolen drive to identification of what was on the drive in one day. “Thousands of backup files” to go through. What a difference between this and those who take a month and still can’t figure out what was on a stolen drive.
State and local police are investigating, she said, with assistance from the attorney general’s office.
Guarino said department employees spent Thursday and yesterday tracking down people and telling them about the breach. The department also sent out a letter yesterday to everyone affected by the theft.
Comment: and notification of individuals within 48 – 72 hours after discovery of theft! Fantastic job!
If only they’d had end to end full disk encryption on that drive. Thefts of desktops has risen to a point where disk encryption should be extended beyond traveling laptops to every machine in an environment. Of course, most companies still don’t bother even encrypting their laptops despite the number of executives checking them at the airport or leaving them in the front seat of their car.