Almost daily we hear sad stories about how someone obtains the personal information of another and totally destroys their financial lives by stealing their identities and purchasing vehicles, homes, obtaining credit cards, utilities, medical services, drawing on social security benefits, committing crimes and the list goes on and on. Companies such as LifeLock and FreeCreditReport.com are raking in millions helping people who are trying to avoid becoming victims themselves.
No matter how vigilant you are in protecting your personal information, there are some things that are out of your control. What do you do when the company you work for has disclosed your name and social security number and apparently didn’t even notify you when this breach of information had occurred?
This in fact happened on January 20, 2009, when Data and Reporting Manager, Thomas Koch of Stanley Baker Hill, LLC in Baghdad, Iraq emailed an Army document entitled “Personal Roster For Monthly Check Cashing” with the names and full social security numbers of 269 employees of Stanley Baker Hill and DAAR Engineering to a mailing list of 106 email addresses. Many of the email addresses were non government addresses such as gmail and yahoo. What need-to-know did these 106 people have in order to be sent this highly sensitive information? NONE. In addition, many of the people on the list no longer work for Stanley Baker Hill, LLC and may not even realize this breach occurred. I did notice that Thomas Koch name and social security number are not on the list. According to one former employee on the list, Koch’s response to him when asked about this information breach was, “it’s no big deal”. NEWSFLASH!! It is a HUGE deal!
The DoD has very clear reporting requirements in place and are spelled out in Department of Defense Directive 5400.11 DoD Privacy Program. So I have to ask, “When was this breach of information reported to the DoD?” Isn’t the violation of a DoD Directive by a DoD contractor a contract violation? Where is the DCMA in all this. Where is the Corrective Action Request (CAR)?
SBH is clearly at fault here. Not only for the initial breach, but more importantly for not being pro-active in notifying the people on the list and leading the effort in mitigating the risk for potential identity theft. People screw up, it happens. But to not step up immediately and assist your employees in protecting themselves shows a clear lack of professional ethics and a total lack of concern for your employees. I am starting to wonder if the news of this breach has even reached the corporate offices of Stanley Consutants, Michael Baker Corporation, Hill International, or DAAR Engineering. I have emailed each company to informed them of this article and asked for a statement. As of the publishing of this post, Michael Baker Corporation is the only company to respond. David Higie responded with “No, we will not have a statement for the article.” If anyone else responds, I will post an update.
As many of you already know, I too have all the documents involved in this breach of information. That in itself proves just how vulnerable every person on that list is. But, please be assured, I have no intention of further distributing, selling, or in any way compromising your identities. But you do have a right to know what I have done with the information. I sent the “unredacted” documents to an attorney in an effort to find out what kind of protections the people on the list are entitled to. I will keep you posted on that. I have sent the “redacted” documents to investigators on the Senate Democratic Policy Committee, Commission on Wartime Contracting, House Armed Services Committee, DoD IG/DCIS and DCAA. (“redacted” meaning only the names and the last 4 of the SS# are visible) I supposed if they want “un-redacted” documents they can request them from Thomas Koch or the DoD. There is no way of knowing who has sent these documents to whom. But you must assume that someone who is intent on committing identity theft has your name and social security number and you must take immediate action.
As many as 10 million Americans a year are victims of identity theft. In 2005, I was working in the Green Zone and became a victim of identity theft myself. I’m not 100% sure of how it happened, but someone was able to hack into my bank accounts and write themselves 1000’s of dollars worth of checks. Luckily, I monitor my money daily and caught it before any checks cleared and was able to recover 100% of my funds.
Every person on that list is a victim of an Information Breach and is at very high risk for identity theft.
This is what I recommend you do ASAP:
1. Contact your financial institutions and talk to a fraud specialist. Inform them of the breach of information and ask them what measure they can take to protect your cash assets. Some financial institutions may assist you with the entire process.
2. Immediately place fraud alerts with ALL three major credit reporting agencies and tell them there has been a serious breach of information within your company. I would call and talk to a real person rather than do it on-line.
To place a fraud alert with Experian click here or contact or call:
Experian fraud division
888-397-3742
P.O. Box 1017
Allen, TX 75013
To place a fraud alert with Equifax contact
Equifax fraud division
800-525-6285
P.O. Box 740250
Atlanta, GA 30374
To place a fraud alert with TransUnion contact
TransUnion fraud division
800-680-7289
P.O. Box 6790
Fullerton, CA 92634
3. Request a copy of your credit reports from ALL three major credit reporting agencies. You might be able to to that at the same time you are placing the fraud alert. You are entitled to one free credit report annually from each credit reporting agency. You can also request your reports here: www.annualcreditreport.com
4. Check your credit reports for accuracy. Each line item on your credit report should have a contact number for the creditor. Contact the creditor and verify each line item.
5. If you find inaccuracies or fraud:
a. Contact the creditor and dispute it immediately with the creditor and the credit reporting agencies.
b. File a police report with your local police department. This is very important.
c. File a report with the Federal Trade Commission
Updated 09/25/09: I was sent this link to the U.S. Army Privacy Incident Report If you are one of the 269 on this list, please take the time to submit this report to the US Army.
I strongly recommend you sign up for some sort of credit monitoring program. Something that will send you an email right away if there are changes such as new accounts or inquiries. Personally, I prefer Triple Advantage via Experian. I get an email alert if there are ANY changes to my report and it ’s affordable at $14.95/mo. TrueCredit via TransUnion also has credit monitoring. I’ve had LifeLock but I prefer being able to access all three reports 24/7 as with Triple Advantage or TrueCredit. Personally, I would stick with one of the “big three” credit bureaus here.
I am not selling anything and I don’t make a penny so it’s your choice which service you chose to use. I also wrote an article for another blog on Identity Theft. There is a lot more in depth information there as well. Click HERE
Personally, I feel SBH should be assisting you with this. But, they aren’t so…..I will.
If you don’t know if you are on the list email me by clicking HERE and I will let you know.
I will be compiling email addresses in the event an attorney wants to take this on as a Class Action. If you want to be put on that contact list email me by clicking HERE. If you already have a Class Action suit in progress let me know so I can pass it on.
If you have been a victim of identity theft, shoot me an email so we can keep track of how many people have been victimized.
And please DO NOT giving out any more personal information to anyone for anything unless you are 100% sure of who you are dealing with. Not DOB, not mother’s maiden name, not DL# NOTHING!! Please by hyper vigilant. This very well could affect your spouse and children as well.
Please make sure all the Task Force SAFE inspectors and other employees of Stanley Baker Hill and DAAR Engineering are aware of this information breach. I am hoping the AP, CNN or another major news outlet will pick this up. But…with the G20 Summit and the riots in Pittsburgh it’s difficult to get the attention of a reporter right now.
Ms Sparky
Other Related Posts: