Hard drive vanishes from VA facility

The U.S. Department of Veterans Affairs has launched an investigation into a portable hard drive that went missing late last month from an Alabama medical facility and may contain personal data on as many as 48,000 veterans.

The department said the external drive, which was used to back up an employee's computer at the Birmingham VA Medical Center, was reported missing on January 22 and may have been stolen. The VA's Office of Inspector General opened an investigation one day after hearing of the breach and notified the FBI.

"We intend to get to the bottom of this, and we will take aggressive steps to protect and assist anyone whose information may have been involved," VA Secretary R. James Nicholson said in a press release Friday.

The VA's Office of Information and Technology is doing its own review, and the employee computer for which the back-up drive was typically used is undergoing analysis for clues about what the hard drive may have contained.

Rep. Spencer Bachus (R-Ala.), whose district includes Birmingham, said his office's initial indication was that as many as 48,000 records may have been compromised, with as many as 20,000 not encrypted. A VA spokesman said he could not confirm that number because the investigation was still in process. He said the department currently has no indication that any personal information was used improperly but is prepared to offer assistance to anyone found to have been affected by the breach.

The episode follows the high-profile theft last May of a laptop and an external hard drive that housed sensitive information about more than 26 million veterans and active military personnel. The equipment, pilfered from the Maryland home of a VA employee, was ultimately recovered and two teens were arrested in connection with the incident in August.

The VA also investigated reports last August of a theft of a desktop machine from the Reston, Va., offices of Unisys, a subcontractor hired to assist with insurance collections for VA medical centers in Pennsylvania. The agency estimated that the computer contained information on about 38,000 veterans, including 2,000 who were deceased.

Incidents at the VA and other federal agencies have prompted calls for better data security practices from Congress. After the first theft, the VA announced a multistep plan, including installing encryption software on all of its laptop and desktop machines.

[marileev]

update: VA Theft 10x Worse

The VA slyly released information on Saturday that the theft is actually worse than the 48,000 individuals initially reportedhttp://www1.va.gov/opa/pressrel/pressrelease.cfm?id=1294

"VA and VA?s Office of Inspector General have learned that data files the employee was working with may have included sensitive VA-related information on approximately 535,000 individuals. The investigation has also determined that information on approximately 1.3 million non-VA physicians ? both living and deceased ? could have been stored on the missing hard drive."

So to my count, 27,035,000 to 28,335,000 individuals affected due to the VA not protecting its hardware and its sensitive information
http://www.iwantmyess.com/?p=165

[marileev]

update: VA Theft 10x Worse

The VA slyly released information on Saturday that the theft is actually worse than the 48,000 individuals initially reportedhttp://www1.va.gov/opa/pressrel/pressrelease.cfm?id=1294

"VA and VA?s Office of Inspector General have learned that data files the employee was working with may have included sensitive VA-related information on approximately 535,000 individuals. The investigation has also determined that information on approximately 1.3 million non-VA physicians ? both living and deceased ? could have been stored on the missing hard drive."

So to my count, 27,035,000 to 28,335,000 individuals affected due to the VA not protecting its hardware and its sensitive information
http://www.iwantmyess.com/?p=165