London Regional ICT Champion

It’s taken less than a month for the great British data loss fiasco – the loss of 25 million child benefit records by Her Majesty’s Revenue and Customs – to die down. With the data loss now off the front page, the Information Commissioner admitted his office was powerless to prevent similar data loss fiascos, the ex-boss of HMRC got himself a new civil service job, and DWP admitted it lost 40,000 housing benefit claimant records on an unencrypted CD.

Other than stupidity or penny-pinching, we’ve no idea why the Government is continuing to put people’s personal details on CD and DVD when the chances of it being lost or intercepted are just too great – as they’ve already shown. It’s not as if there aren’t plenty of commercial solutions for securely transmitting large amounts of data electronically – such as Yousendit.

Now when we look at the 5 biggest data losses in history to date, the surprising thing is that HMRC’s loss of 25m records only gets it fourth place on the list – another excruciating quarter final exit on penalties. As far as our research can tell, TJ Maxx and CardSystems have eclipsed HMRC by some distance.

A quick glance at the top 5 shows us that every data breach was caused by human error – from hacked data centres, stolen laptops, to data carelessly lost in the post.

In HMRC’s case highly paid managers who should know better routinely abdicated the transport of social security details to lowly paid underlings and temps who didn’t know better. Does our data really matter that little to the Government? It clearly doesn’t matter because the secure e-networks of the Foreign Office and MoD aren’t being used for the secure transport of social security details.   Why not?  Probably because penny-pinching managers were desperate to escape the silly costs of inter-departmental recharges.

So here’s the top 5 data losses – to date – in all their cringing glory.

#1. TJX (TJ Maxx) (2007) – 45.7m customer records across the globe stolen from its secure payment processing centre.

#2. CardSystems (2005) – 40m credit card records – including Mastercard – hacked from its secure payment centre.

#3. United States Veterans Administration (2006) – 26m plus records taken from a stolen laptop.

#4. HMRC (2007) – 25m child benefit records on 2 CDs, lost in the post.

#5. Citigroup (2005) – 3.9m records on computer tape, lost by UPS in transit.

So let that be a lesson to you.