The disappearance of a DaimlerChrysler Financial Services Canada Inc. data
tape -- which contained customer names, addresses and social insurance numbers
-- can serve as a strong warning for enterprise data protection, analysts say.

The auto giant's lending division recently told the Office of the Privacy Commissioner
of Canada that sensitive personal information from thousands of Canadian auto
customers had gone missing in transit from Farmington Hills, Mich. to a Quebec
credit agency. The mainframe data tape, which was shipped via United Parcel
Service Inc. (UPS), has been missing since early March."

A spokesperson for federal Privacy Commissioner Jennifer Stoddart told ComputerWorld
Canada Wednesday that its office has received about 50 inquires from individuals
that might have been affected by the data loss. The commissioner's office said
it is still determining the next course of action.

"We're communicating to Chrysler directing to determine actually what
took place and what's being done to remedy the situation," spokesperson
Anne-Marie Hayden said. "I can't say for sure whether we've had a formal
compliant from an individuals or not, but that may well take place in the future."

Hayden did not mention UPS specifically, but said the commissioner's office
would be discussing the matter with all other relevant parties involved.

Chrysler Financial Services Canada could not be reached for comment at press
time.

The case draws parallels to a major Canadian data loss incident last year,
where CIBC's mutual fund subsidiary Talvest Mutual Funds lost a backup drive
containing personal and financial data of 470,000 individuals while it was in
transit between Montréal and Toronto. That data breach was also investigated
by the Privacy Commissioner's office.

The major issue in both cases, according to one Canadian security observer,
is the measures that these companies took before the data went missing in action.
Info-Tech Research Group's James Quin said the loss of a generic backup data
tape is not too concerning -- especially if it's only a slice of information
from the server. But the Chrysler case, he said, presents an entirely different
story.

"It was a discreet set of data, where there was one data pool that have
been backed up onto this tape and sent out," Quin, senior research analyst
with the London, Ont.-based research firm, said. "The beginning, middle
and end of all the data was on this tape, which does make it more accessible.
As long as you've got a tape reader, you will be about to get this information."

Even more concerning for Quin though, and what should serve as a warning sign
for all enterprises, is the fact that Chrysler has not mentioned the magic 'e'
word throughout this entire ordeal.

"At no

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine