The FDIC’s Story on Data Breach Response

The FDIC has been plagued with a number of data breaches recently, and a congressional report details the story and facts, along with FDIC’s cooperation (or lack of), relating to two breaches caused by separating employees removing confidential information.  The report is an interesting read, and provides a lot of how-not-to report and respond.

The report details one story and includes FDIC comments, along with the findings from the governmental investigation.  In short:

The Story:  On February 26, 2015, the FDIC notified Congress that a breach occurred on October 15, 2015 and that the FDIC learned of the breach on October 23, 2015.  The notification stated that a separating employee, inadvertently and without malicious intent, copied sensitive FDIC Information, which included customer data for over 10,000 individuals to a portable storage device (thumb drive).  The FDIC later, on March 18, 2016, updated the information to over 44,000 individuals.

The Facts:  The data included 71,069 individuals and entities (40,354 individuals and 30,715 banks and other entities), along with Suspicious Activity Reports, Bank Currency Transaction Reports, and Customer Data Reports.

The Story:  The former FDIC employee was simply trying to download family photos when the PII was transferred to the thumb drive.  FDIC’s Chief Information Officer stated the individual was not computer proficient.

The Facts:  The former employee created two folders on the thumb drive, one for a small set of personal files and another solely for FDIC materials, with each of the FDIC files conveniently labeled with bank names or with the type of bank data in the files – demonstrating an understanding of computers, downloads, and storage.  Mind you, the former employee also holds two masters degrees, including one in Information Technology Management.

The Story:  The former employee was non-adversarial and cooperative in recovering the portable storage device.

The Facts:  At first, the former employee denied owning a thumb drive and stated she would never do such a thing.  She later hired an attorney to engage in a negotiation of return of the thumb drive.  The FDIC did not recover the thumb drive for nearly two months.

I recommend those in IT security, and those that enjoy an almost fictional, non-fiction tale, take a look at the report.