Man finds old computer with confidential consumer data
 

http://ksla.com/Global/story.asp?S=3262648

LAFAYETTE, La. For nine dollars at a Goodwill store, Robert Zorn picked up a used computer and a surprise inside: the confidential data of hundreds of Lafayette area residents.
The original owner of the computer, Coast Capital Mortgage, is threatening legal action. Lafayette police are investigating whether Zorn committed extortion when he offered to sell the computer back to the firm for 35-hundred dollars.

The computer contains names, Social Security numbers, loan applications and full credit reports for at least 800 people.

Zorn said he offered to sell the computer after refurbishing it to the company for three-thousand-500 dollars, a price he said he would receive on the open market, and asked that the company notify its customers of the mistake.

The company declined the offer and made an extortion complaint to the police. Zorn said to avoid any trouble, he voluntarily took the computer to the district attorney's office and said he does not want any money.


************************************************

Heh.. pretty much it.. though..

Honestly, isnt the puter techs responsible for this? Granted the "right" individuals can get deleted info off a wiped HD, could this have been a slip up on thier part?

I find it funny that the old man tried to get money back on it.

Heh good thing some kid didnt come along and buy it. "lets see what do i want off ebay"

still blows my mind how slip ups like this happen.

sorry Mr. Drider. Seems someone cleaned out all our customers account savings. but we are looking into it. Btw your now a 18 year old girl with braces according to your Information. huh?

now that would be a gut wrenching find to have to go through.

I used to have a computer business, and I'd take old computers from just about anywhere and make Frankenstein machines and give them away to people who couldn't afford new ones.

I saw so much private data it was stupefying. From banks, local and state welfare agencies, businesses, the whole 9 yards. There would be financial data, family data, email, tons of porn, etc. I would always zero out the drives, but the openness of that info always surprised me.

I have most of the HD of my personal computers. I never toss them out with the whole CPU.

I just gave away three old computers to a salvager... he seemed rather disappointed thata I yanked the hard drives out of all of them...

Every company I have ever worked for, every so often, we'd dispose of old equipment, either via intercompany sales, or to salvagers, we'd spend days fdisking the drives just so any data would be destroted... or at least make it harder for people to get back.

I'm going to come out and suggest that he had the right to offer to sell it back.

He discovered an apparent slip-up on their part, and asked for compensation in exchange for helping them fix their mistake. I don't see a problem with that.
He didn't have to return the drive to the police. He bought it, and all associated rights to it from the salavage company (goodwill). That means the data is now his. The company abdicated it's right to the data by failing to erase the drive before selling it.

If I bought a used car, and found a bag with $100,000 under the floorboards, the previous owner has no claim to that money.

No obviously I am not speaking about this from an ethical standpoint, simply a legal one.
The charge of extortion is the company's reaction to being embarrased.

I wonder if the company has notified their customers that their personal data was breached, or that the company was at fault?
I don't see it happening. The company would rather spend a million on a lawyer against this guy for "Extortion" than $1.25 to fax out an apology.

So in sum, what was wrong with paying $3500 to fix a screw-up on their part?

Damn right he should sell it back. Before he did that he should have made a list of everyone who had data on the computer and tried to contact as many as possible so that they know how mismanaged their data is.

I agree.. this is the local news station here where i live.. i sent them an email suggesting that they follow it up and see what happens. he should have copied the names of everyone then posted it as a letter to the editor and stating how a slip up that really was. granted the bank would go after him for slander or such but wouldnt hold jack heh

I find it odd that in another thread a surrogate mother is being praised as selfless for foregoing her fee, and yet in this topic extortion is championed.

I'ts not extortion. He is not blackmailing them. He offered to sell them a computer he refurbished and had their data on it. He didn't say, buy it or else.

I think all of the people who have information on that computer should be contacted to see if they want to sue the mortgage company for breech of privacy.

That does seem to be the American solution to everything.

I'd rather the company contact ALL their customers from the past 40 years, and mail them information regarding protection their privacy and what they will do to protect it in the future.

holding a company responsible for a breach of written contract? Hell yeah.

Buyer beware doesn't exist in a regulated state such as the US. Caveat emptor is a rather draconian and unethical business philosophy. The US realizes this, and strives to protect the consumer in a hundreds if not thousands of ways in their everyday lives.

As someone looking to make a career in the business world upon graduation in little less than a year, these are the types of issues provided us in our classes--and how not to screw up in such a manner.

The company is clearly in the legal and ethical wrong for violating their customers' privacy rights along with their contract with said customer regarding protecting that sort of information. On top of that, rather than accepting responsibility, they've filed charges against the man. They had no legal rights to the information they forfeited him, so they should have been wiling to pay the fair market value of the information (and even a bit more to maintain customer/client goodwill), which is FAR above 3500 dollars. They honestly must not value their customers, therefore, I have no sympathy for them at all. Anyone that could claim their clients' privacy is worth less than 3500 dollars doesn't deserve to be in business. The man should sue them for slander, breach of contract and neglect on the behalf of their clients (the last two charges as a class-aciton suit). Slander could actually be upheld because the company was dumb enough to file extortion charges (which, if the charges are found insubstantial with a grand jury, show obvious malicious intent on the part of the company--which is one of the precedents for slander).

Any company this careless and dumb doesn't deserve to stay in business and should be shut down. It endangers and undervalues its clients. end of story.

The amounts of data that can be recovered from a "wiped" hard drive is staggering. My HD was accidently formatted (sp?), but a program bought on the web for $80 restored almost every file. My dad who is quite the expert on computer security was surprised it was so easy. I'm all for recycling computers and stuff, but aside from keeping the HDs, are there any way to prevent these things?

Yes -- overwriting several times. There are programs that write the same small bit of binary data -- a zero -- over every writable space of the hard drive. It has to be done several times, because magnetic shadows of what was previously there remain. Many people "zero-out" their drives to wipe them clean about half a dozen times, to be certain of erasing residue of stored data. The drive with then appear to be a clean, unused drive under most inspections.

Birds of a feather...
 

I don't think I have ever agreed with anyone word-for-word...okay, well, maybe...Regardless...BRAVO! I couldn't have said it better myself!

I really am disappointed to read that the man was intimidated enough to turn in the computer and verbalize an intonation of defeat...I'd have taken it to court - never mind the time I would take (recruiting my supportive friends and family) in making the details to this situation as public as possible. The public has a damn good right to know of this company's horrible oversight or mistake...whatever one chooses to call it. This is a BIG f*ck up...

Not only is this company's face red, but now they look like frightened, angry and vindictive bullies. They just ruined their own reputation far worse than this man could have done...just my thoughts on it, anyway. :)

hehe here's an official update on this ..

http://www.ksla.com/Global/story.asp?S=3274509

LAFAYETTE, La. The company whose employee donated to charity a computer containing private financial data on hundreds of people could face legal sanctions.
The computer turned up in a Goodwill store where Robert Zorn bought it for nine dollars. Zorn found confidential information about hundreds of customers of Coast Capital Mortgage Company stored on its drive.

Coast Capital said the employee who donated the computer still works for the company, pending a decision on possible discipline.

Cindy Richardson, a Lafayette resident who works as a security auditor, says the company could face lawsuits and possibly an investigation by the Federal National Mortgage Association.

Coast Capital says Zorn tried to extort the company for three-thousand-500 dollars in exchange for the computer. Zorn claims he just wanted to sell the computer back to the company.

Lafayette police are investigating the extortion claims. On Tuesday, a judge granted a temporary restraining order, demanding Zorn turn over all information he got from the computer and barring him from using or releasing the data.

Mr. Zorn needs a lawyer right now, and a good backup of that data in a safe-deposit-box that he has not copped to renting in court.

He is about to be taken to the cleaners by this company simply becuase he found their mistake and made it public. defamation is only the begining of what they are going to do...

Moral of the story:
When you catch a screwup that endangers people or their data, Make sure to document this screw up in multipule forms, pass these out to freinds and family for safe keeping, then contact the company and tell them they need to start issuing an apology.

As pointed out before, this company obviously feels that their customers are worth less than $3500

"pending a decision on possible discipline"

so this perons is just sitting there waiting on them to decide.. man screw that no way i'd let that much stress build up in me. I'd have to quit and walk out. I mean wtf sounds like some high school bit now.

lol just wish i had the name of the company.. think ill call a relative down that ways and ask if they know.