Iron Mountain Loses More Tapes - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Iron Mountain Loses More Tapes

Backup tapes from City National Bank were lost in April, but there's no evidence the data has been compromised, the bank says.

City National Bank has become the second company in two months to experience a loss of backup tapes in transit by Iron Mountain Inc. The Los Angeles-based bank disclosed Thursday that two tapes containing sensitive data, including Social Security numbers, account numbers, and other customer information, were lost during transport to a secure storage facility.

The bank said the data was formatted to make the tapes difficult to read without highly specialized skills, but declines to say if they were encrypted. It said there's no evidence that data on the tapes has been compromised or misused.

Iron Mountain said it lost the tapes in April. The tapes were in a small container of backup tapes belonging to a Texas-based Internet services provider that hosts applications for City National and other banks. The incident has been investigated by federal law-enforcement officials and no evidence has been found of identity-theft relating to the loss.

In May, Time Warner revealed that tapes containing data, including names and Social Security numbers, on 600,000 current and former employees disappeared in March while being shipped to an offsite storage facility operated by Iron Mountain.

Other lost-tape incidents that have made headlines this year have involved Bank of America, Citigroup, and Ameritrade.

In a letter to customers, City National said it was conducting a comprehensive review of its security procedures. "Clearly, information security is a growing concern throughout business everywhere," the letter said.

Iron Mountain, in a statement, said, "Given the criticality of disaster recovery and the need for privacy protection, we continue to recommend that companies encrypt back-up tapes that contain personal information."

Under California's Security Breach Notification law, companies are required to provide notice of a breach in the security of data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. In providing notification, City National did "more than was required" on behalf of our clients, a spokeswoman says.

A bill introduced last month in Congress would require such notification, but exempts companies if a risk assessment conducted with law enforcement determines that the risk of fraud is minimal. It also exempts companies if compromised data can't be used to commit fraud or if the company has a security program reasonably designed to block the data's use for fraudulent transactions.

Only 7% of businesses encrypt all backup tapes, according to Enterprise Strategy Group. Alternatives to backup tapes, such as electronic disk backups, are being used by many companies; Citigroup is starting to use it this month following its tape-loss incident.

AmeriVault Corp., a provider of disk-based backup systems, is recommending that customers prioritize applications for backup purposes and designate the most critical ones for disk backup and less-critical ones for tape. "You don't need to rely on one solution," says AmeriVault president and CEO Bud Stoddard. Prioritization, he says, "allows you to protect 10% to 20% of your data electronically instead of relying on trucks and tapes."

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
The State of IT & Cybersecurity Operations 2020
The State of IT & Cybersecurity Operations 2020
Download this report from InformationWeek, in partnership with Dark Reading, to learn more about how today's IT operations teams work with cybersecurity operations, what technologies they are using, and how they communicate and share responsibility--or create risk by failing to do so. Get it now!
The Best Way to Get Started with Data Analytics
John Edwards, Technology Journalist & Author,  7/8/2020
10 Cyberattacks on the Rise During the Pandemic
Cynthia Harvey, Freelance Journalist, InformationWeek,  6/24/2020
IT Trade Shows Go Virtual: Your 2020 List of Events
Jessica Davis, Senior Editor, Enterprise Apps,  5/29/2020
Register for InformationWeek Newsletters
Current Issue
Key to Cloud Success: The Right Management
This IT Trend highlights some of the steps IT teams can take to keep their cloud environments running in a safe, efficient manner.
White Papers
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Sponsored Video
Flash Poll