The FDIC has notified former and current employees of the agency that personal data including name, date of birth, salary, Social Security number and other information had been stolen several months ago.
Although the data theft was discovered in March and letters were sent to affected employees at that time, the FBI subsequently found that data of all former and current Federal Deposit Insurance Corp. employees—not only those notified by the FDIC in March—had been compromised.
Not only is the security breach embarrassing for the FDIC, it's also ironic, because the FDIC's job is to issue alerts to financial institutions about how to handle sensitive information, said Gerry Gebel, senior analyst at Burton Group, a Midvale, Utah, research and advisory firm.
The security breach at the FDIC is just the latest in a series of high-profile cases of identity thefts.
In March, for example, Bank of America Corp. lost several data tapes containing personal information on more than 1 million federal employees.
Also in March, BJ's Wholesale Club Inc. disclosed that customer information was compromised—something the Federal Trade Commission attributes to the wholesale club failing to encrypt data.
To help stem the rising tide of identity theft, Congress is currently mulling over several potential laws that, similar to California SB 1386 and those in process in several other states, would require organizations disclose any unauthorized acquisition of information.
In the U.S. Senate, Dianne Feinstein, D-Calif., has introduced such a bill, dubbed the Notification of Risk to Personal Data Act.
Meanwhile, U.S. Rep. Melissa L. Bean, D-Ill., has introduced a companion bill that would require the government or any business that owns or licenses electronic data containing personal information to notify anybody whose personal information has been compromised. The bills also would create a clearinghouse to collect, track and report data breaches.
Sens. Charles Schumer, D-N.Y., and Bill Nelson, D-Fla., also introduced an identity theft bill that would give broader authority to the Federal Trade Commission and require more disclosure.
The Schumer-Nelson ID Theft Prevention Bill will create an FTC Office of Identity Theft to help victims of ID theft reclaim their identities more easily, regulate data merchants, and force companies to inform consumers in plain English that their information may be sold or given to an unaffiliated third party without their consent unless a box is checked.