Nationwide Looses 11m Customers information

whambamboo

anniecave wrote:

In fairness though, I can see where they are coming from. I work for a company, and on my laptop there is some customer information relating to the job I do. In my case, it is just an information dump of customer information because I have been doing some work at home on the data. Mine are business customers relating to electricity accounts. Now my computer is password protected, and I don't know what use that information would be, but it would be a similar issue if someone nicked my laptop, or if I had a desktop and someone nicked that.

If they are assuring customers that "no PIN numbers, account passwords or memorable information was on the laptop" then it would be quite hard work for anyone to actually do much damage or obtain money fraudulently. Sure someone could send out scam emails or postal circulars or put the details on a mailing list, but they can get the same information from the phone book or random generation of email addresses, so it's not really such a big issue I wouldn't say.

Yeah it shouldn't have happened, but hey there you go.

Banks are very highly regulated and there should be multiple procedures to stop this kind of thing happening. There is no excuse for keeping this kind of data on a laptop.

ReportInvestor

Banks would naturally say that this is what you get if building societies play at being banks.

tee_pee_2

i am with nationwide for several accounts. Can I take my passbooks in to the bank and ask them to check over if there has been any activity?

Robert_Sterling

I noticed that over the last few days the Nationwide website always tells me when I last logged before it lets me continue.

Sapphire

This coupled with the rumour that this outfit is thinking of starting to charge current-account holders around £120 per year for having an account (unless they have a substantial sum in the account), and its very low interest rates on its savings accounts and ISAs, is really making me think about changing banks. I've already withdrawn a substantial sum from one of their accounts and placed it with a company that pays a much higher interest rate.

I don't think what is happening to this company bodes very well for its customers, and perhaps not for the company itself - it's making me quite nervous about it, frankly. :eek:

ManAtHome

anniecave wrote:

Now my computer is password protected, and I don't know what use that information would be, but it would be a similar issue if someone nicked my laptop, or if I had a desktop and someone nicked that.

If they are assuring customers that "no PIN numbers, account passwords or memorable information was on the laptop" then it would be quite hard work for anyone to actually do much damage or obtain money fraudulently. Sure someone could send out scam emails or postal circulars or put the details on a mailing list, but they can get the same information from the phone book or random generation of email addresses, so it's not really such a big issue I wouldn't say.

Yeah it shouldn't have happened, but hey there you go.

If somebody nicked your machine, they could easily get the data off the hard disk - a PC password is no use when the disk is in another machine. Even been on the Beeb about PCs with hard disks being transferred by the container-load to Nigeria (home of many scams) - http://news.bbc.co.uk/1/hi/business/4790293.stm

One of the things which help make scammers much more plausible is having an Account number... Is date of birth regarded as "memorable information" (it is to a crim). How would your company feel if their competition knew exactly what deals they were making, Customer contacts etc - pretty minor compared to "losing" bank account details..?

I prefer the "keeping things secret and shredding useful detail" rather than the "well these things happen" approach and I take the same care over Customer data wherever I'm working - I'm surprised you'd expect less...

[Deleted User]

ManAtHome wrote:

I prefer the "keeping things secret and shredding useful detail" rather than the "well these things happen" approach and I take the same care over Customer data wherever I'm working - I'm surprised you'd expect less...

It totally agree! Various 'experts' appear to take a different view to those here who think some of us are making a fuss about nothing. See: http://news.bbc.co.uk/1/hi/uk/6160800.stm

Nationwide don't appear to have denied that names and account numbers could have been taken. There have been question marks today over whether addresses/phone numbers/dates of birth were also on the laptop, hence the warnings that identity thieves may well leave customer's accounts alone and instead go off and take out credit card in the customer's name. That's why there have been warnings not to give any details over the phone should someone phone, purporting to be a Nationwide staff member, asking for your security details, before entering into conversation about the security breach or an account issue.

I still believe Nationwide should have alerted it's customers to the breach long before now, rather than be forced to do so at this late stage because someone worried enough has got the info into the public domain. The laptop theft needn't have even been mentioned. Nationwide should have put out a statement, without going into details, saying there had unfortunately been a breach in their security system that was being dealt with, however to be on the safe side they were asking customers to be extra vigilant re any phishing attempts etc, as they have done today. Yes they would have been heavily questioned on it, but there are ways round these things.

It's bad enough the entire database was downloaded on to the laptop, but it is far more worrying to me that Nationwide aren't saying there is nothing for us to worry about because the information was secure as it had been encrypted! :shocked:

A_Nice_Englishman

I used work in the IT department of a large financial company. The hard disks of employee laptops were encrypted and needed a long and complex password even to boot up. If the password was forgotten the employee had to bring the laptop in, connect it to the corporate network, contact the IT Department and identify themselves by answering a secret question. Only then could we reset the password.

If the Nationwide laptop had that kind of protection they could say the data was secure. As they're not saying this one wonders what security there was.

whambamboo

Al_Mac wrote:

I do work in an IT department of a financial institution. Staff are always losing folders, palm tops, laptops etc. Normaly with info of the more impotant "clients" on.

I trust you gave those looking after the impotent clients a "stiff" warning.

edda

ReportInvestor wrote:

I just can't see the justification for having that amount of member's information on a lap top and I shall ask them about it at the next AGM.

Or if anyone is free on 23rd November 2006

Book your place at the next "Members meet the directors" forum in the Emirates Stadium in London where you can put the question to Stuart Bernau and Jeremy Wood

London too far away to make it - but if you could let us know what their reply is, I'd be fascinated to hear it. :T