NH students, veterans, residents each victimized by identity thieves

Sept. 28--What do 674 University of New Hampshire students, 371 Granite State veterans and 393 New Hampshire residents with ties to Butler University share in common?

They all received notices this year that they might have had their personal information stolen and/or compromised, leaving them open to potential identity theft.

The three groups were listed as potential victims among more than 120 possible or suspected data branches reported to the New Hampshire Attorney General's Office just this year -- one every two calendar days.

"We get a frighteningly large number of these," said James Boffetti, a senior assistant attorney general and chief of the Consumer Protection and Anti-trust Bureau. "I think it's a problem increasingly we're going to face in this society as more things are done online."

Cyber criminals don't respect state borders, with companies from more than 25 states reporting incidents to the Attorney General's Office this year, according to a review by the New Hampshire Union Leader.

"These are sophisticated cyber attacks that are coming at corporations," Boffetti said. "Despite all their talent and all their security, they're being outsmarted in some cases by these sophisticated cyber attacks."

Many incidents

In the case involving UNH students, TD Bank last Jan. 16 emailed a file containing student names and bank account numbers to the university in a way that was "inconsistent with our standard protocol." The university employee receiving the file immediately notified the bank, which said it didn't believe it or any students were at risk. It offered two years of free credit monitoring to those students who qualified.

The VFW was notified on March 4 that a hacker downloaded information, including names, addresses and Social Security numbers, for 55,000 VFW members. The hacker, suspected to be from China, was looking "to gain access to information regarding military plans or contracts," according to a letter from Quartermaster General Robert Greene.

He said officials can't be certain this was the sole motive, and "the hacker accessed the type of information that puts you at risk for identity theft."

And at Butler University in Indiana, hackers accessed files containing the personal information of 393 Granite Staters, including personal information that may have included Social Security numbers, driver's license numbers and bank account information.

Manchester'sElliot Health Systems reported it became aware in March that information of two New Hampshire residents may have been accessed by an unauthorized person in connection with the theft of four computer work stations.

The information included names, addresses, telephone numbers, dates of birth and health information. Also included were one person's Social Security number and another's health insurance number.

Nearly 2,000 miles away, the Montana Department of Public Health and Human Services found out last May that a computer server had been hacked containing information related to agency employees, clients receiving services or individuals for which the department may have records. They identified and notified 132 New Hampshire residents.

Affected companies typically send notices to the affected individuals and contact information for credit report monitoring.

Equifax, one of the big three credit report monitoring companies, reported to New Hampshire that it was a victim itself, as well as 14 New Hampshire residents. A hacker obtained credit reports using sufficient personal information to meet Equifax's identity verification process.

Data breaches not only affect personal information but sometimes involve stealing credit and debit card numbers to run up fraudulent card charges.

"Each day, we're seeing an increase in the number of cards that have been breached," said Christiana Thornton, president and CEO of the New Hampshire Bankers Association.

Neiman Marcus reported a "criminal cyber-security intrusion" where malware was active in its payment system from July 16, 2013, to Oct. 30, 2013. The company said 1.1 million unique payment cards were used during that stretch. The retail chain didn't possess addresses for 31 percent of those card owners but identified 822 residents who used a card during that time.

By January 2014, Neiman Marcus said about 2,400 unique credit or debit cards used at their stores -- including two cards belonging to New Hampshire residents -- were later used for fraudulent activities, but the company said it only had addresses for 71 percent of those cardholders. No dollar totals were given for the fraud.

Legal Sea Foods learned that another company that runs a segment of the seafood company's mail order web sales and e-commerce sustained a breach, potentially affecting 94 Granite Staters, according to its notification letter.

Transactions made between Jan. 1 and May 21 were potentially affected, with information accessed that may have included customer names as well as credit card numbers, expiration dates and card verification values (CVV). Restaurant transactions weren't affected.

"Sometimes, it's done in such a way that the company's not aware of it and it takes a little time for the company to figure out what's going on," Boffetti said.

Other times, personal information is put at risk the old-fashioned way.The Coca-Cola Company notified New Hampshire in January that several laptops were stolen and recovered, but one or more laptops included employee or other names along with personal information, affecting 17 New Hampshire residents.

"It's sobering to see how many and is indicative of a bigger problem," Boffetti said.

Consumers pay the price in the end.

"It's eventually added on as a cost of doing business," Boffetti said. "That's how our system works. Companies have to work to make a profit. They obviously absorb some of the loss. In the end, we end up paying for it in higher fees and higher costs of products."

[email protected]

------

___

(c)2014 The New Hampshire Union Leader (Manchester, N.H.)

Visit The New Hampshire Union Leader (Manchester, N.H.) at www.unionleader.com

Distributed by MCT Information Services