Until recently, this type of problem was not even required to be disclosed. I understand a lot of states enacted laws requiring disclosure of such compromises back in 2006 when some major events like this one were disclosed. Currently 39 states had some form of security breach laws according to the Public Interest Research Groups website on Identity Theft Protection. Hope you don't live in one of the 11 that don't. ” target=”_blank”>http://www.uspirg.org/financial-privacy-security/... There are some crazy stories out there that I get from a few security projects I've worked myself in the past, but mostly through some of my insider contacts in the IT security industry. For example, there was a bank about 2 years ago which had been breached for over 12 months before they detected the problem. I say over 12 months because the bank didn't t have audit trails going back further than that. In addition, due to numerous technical issues (primarily the lack of sufficient accounting, time tracking and insufficient layers of security), it was not even possible to forensically detect which systems had been compromised or how the problem even occurred in the first place.

Until recently, this type of problem was not even required to be disclosed. I understand a lot of states enacted laws requiring disclosure of such compromises back in 2006 when some major events like this one were disclosed. Currently 39 states had some form of security breach laws according to the Public Interest Research Groups website on Identity Theft Protection. Hope you don't live in one of the 11 that don't. ” target=”_blank”>http://www.uspirg.org/financial-privacy-security/... There are some crazy stories out there that I get from a few security projects I've worked myself in the past, but mostly through some of my insider contacts in the IT security industry. For example, there was a bank about 2 years ago which had been breached for over 12 months before they detected the problem. I say over 12 months because the bank didn't t have audit trails going back further than that. In addition, due to numerous technical issues (primarily the lack of sufficient accounting, time tracking and insufficient layers of security), it was not even possible to forensically detect which systems had been compromised or how the problem even occurred in the first place.