ie8 fix
madison

Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev

Countrywide warning: Ex-employee (may have) sold customer, mortgage data

By | September 9, 2008, 12:27pm PDT

Summary: Countrywide Mortgage has started notifying customers that a rogue employee (since dismissed) may have sold sensitive personal information to an unidentified third party. The company mailed “urgent security notification” letters to customers this week, warning that the customer information involved included names, addresses, social security numbers, mortgage loan numbers and “various other loan and application information. Here’s [...]

Countrywide warns about rogue employee selling personal dataCountrywide Mortgage has started notifying customers that a rogue employee (since dismissed) may have sold sensitive personal information to an unidentified third party.

The company mailed “urgent security notification” letters to customers this week, warning that the customer information involved included names, addresses, social security numbers, mortgage loan numbers and “various other loan and application information.

Here’s a portion of the letter I received the morning (I’m a Countrywide customer):

countrywide letter on internal sale of customer data

(Click image for larger version)

The company said it will take “necessary precautions” to monitor the mortgage accounts of affected customers and promised to issue notifications “if we detect any suspicious or unauthorized activity related to this incident.”

[ SEE: LendingTree insiders leak customer data ]

The Countrywide notification letter comes more than a month after the FBI arrested two men — on a former Countrywide employee — on charges related to a scheme to steal and sell sensitive personal information, including Social Security numbers, of as many as 2 million mortgage applicants.

The insider was identified as Rene L. Rebollo Jr., 36, who had worked as a senior financial analyst at Full Spectrum Lending, Countrywide’s subprime lending division. He was arrested at his home in Pasadena and charged with unauthorized access to a financial institution’s computers.

In an affidavit filed in federal court, the FBI said Rebollo had voluntarily described the scheme. Rebollo said he would charge $400 or $500 for batches of thousands of “leads” — personal and account information that presumably would help outside loan agents solicit new mortgages from the Countrywide applicants, some of whom had been denied loans by the Calabasas company.

Authorities said they didn’t know whether any of the information had been used for outright fraud, such as identity theft.

Rebollo would copy information on about 20,000 customers at a time on Sunday nights by using a Full Spectrum computer that did not have the same security features that other machines in the office had, according to the affidavit by FBI Special Agent Richard P. Ryan.

At that rate, the U.S. attorney’s office said, Rebollo would have compromised up to 2 million customer profiles for about 2.5 cents each — an astonishingly small amount considering the importance of the material. Mortgage leads are among the most expensive for sale because of the potential payoffs to intermediaries when loans are made.

Earlier this year, LendingTree had a similar internal problem with the sale of customer data to third parties.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues.

Disclosure

Ryan Naraine

The most important disclosure is of my employment with Kaspersky Lab as a member of the global research and analysis team. Kaspersky Lab is a global company specializing in anti-malware and secure content management technologies. I do not own stocks or other investments in any technology company.

Biography

Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues. He is currently security evangelist at Kaspersky Lab, an anti-malware company with operations around the globe. He is taking a leadership role in developing the company's online community initiative around secure content management technologies.

Prior to joining Kaspersky Lab, Ryan was Editor-at-Large/Security at eWEEK, leading the magazine's and Web site's coverage of Internet and computer security issues and managing the popular SecurityWatch blog, covering the daily threats, vulnerabilities and IT security technologies. He also covered IT security, hacker attacks and secure content management topics for Jupiter Media's internetnetnews.com.

Ryan can be reached at naraine SHIFT 2 gmail.com. For daily updates on Ryan's activities, follow him on Twitter.

40
Comments

Join the conversation!

Just In

RE: Countrywide warning: Ex-employee (may have) sold customer, mortgage data
Drea80 20th Mar 2009
Davis and Davis is another law firm that is doing a class actioin suit against countrywide if you got a letter stating that your info was stoling you should call and join the suit.Call James P. Davis at 716-847-2606
0 Votes
+ -
now what
balaway@... 9th Sep 2008
I got the same letter. Took advantage of their
monitoring offer but that doesn't make me feel any
safer. What security precautions have you taken since
receiving this letter?

Are their any class action law suits related to this?
0 Votes
+ -
Class Action
bungeerush 11th Sep 2008
Lets start obne right away.
0 Votes
+ -
Gets my vote. Sign me up now
sjenovai@... 11th Sep 2008
Any attorny want to address the feasability of this? count me in.

I just received my letter from Countrywide. Over a month after they KNEW information had been stolen.

Thus far my wife and I have spent HOURS trying to follow the protocol that we were advised of. With no success so far. Lots of busy phone lines, and cryptic autoattendant prompts.



My interpretation of the Countrywide's repsonse:

Oops, we screwed up. So Sad, Too Bad, You're Had! Don't expect us to take any REAL action to protect YOUR identity. If YOUR credit gets screwed up, its your own D>>N fault you didn't spend hour upon hour trying to fix it. Just keep those mortgage payment checks commin'
0 Votes
+ -
Am I the only person who feels that the IT industry, smart folks like us, should be lobbying Congress to make data protection and privacy part of the high priorities for next year? No one is held responsible, from what I see, at the executive levels of companies for maintaining data privacy and security. So they fire the CIO, or some underling. It seems it should be a mandate, and let the market figure out the best technologies to protect us from unauthorized access. And that means long prison sentences for folks like these.
0 Votes
+ -
Yup
ZachE84 9th Sep 2008
I agree 100% (see my other post). These companies just don't give a **** because the government doesn't give a ****. Let's hope a Senator's account was compromised and he gets his credit report affected happy
Good information. Just found this article because I got the letter too. I can't believe that they are only offering 2 years of the credit monitoring. Whoever has this personal information can essentially use it many years down the line to steal our identity and ruin our credit.

I am in the IT industry and I find it alarming that this information is available to financial analysts. Social Security #'s should be encrypted across all user databases and should be abbreviated whenever displayed.

-A. Narain
0 Votes
+ -
fight back with alerts, locks, freezes
killerbunny 9th Sep 2008
You can request the major credit reporting bureaus to put a temporary 90-day fraud alert on your credit file or a longer-term lock/freeze. With a fraud alert (which I have done since I received the Countrywide notification, too), lenders and other vendors accessing your credit file will see a notice that you may have been a victim of identify theft and will be more careful checking any applicant. Yeah, I know, it sucks that it takes special action to make the vendors "careful" with your data. If you use these methods to restrict access to your credit file, you, yourself, will have problems getting new lines of credit, too. Some credit bureaus allow you to initiate a fraud alert via their website, but all require a written letter to remove the alert/unlock the file. I think the credit bureaus deliberately make it difficult to unlock your file just to discourage you from locking it in the first place. After all, the bureaus make money selling your data to lenders. After a friend in financial services warned me about prevalence of identify theft years ago, I have subscribed to triple-bureau credit monitoring with email/text message alerts sent when there is any activity on any account.

http://www.consumersunion.org/campaigns/learn_more/003484indiv.html

Also, some banks (such as Bank of America) will text message a special temporary code to your cell phone and require that special code for you to access your bank account via the website.
0 Votes
+ -
Execution of willful offenders
wolf_z 10th Sep 2008
There's no doubt about guilt in cases like this. This was a willful deliberate act, done with malice forethought.

The more scumbags die over things like this, the fewer problems we'll have.

And yes, I'm particularly venomous toward people that betray trust like this. There's no excuse for it and it could cause a major catastrophe for innocents.
Something must be done. Everyday!!! something like this occurs. Companies get no flack or legal issues done against them. Hence, they won't try to prevent it in the future.

A few days ago I got this same letter, but from BNY Mellon about my 401K. Apparently they lost a tape backup of data from one of their trucks. Such BS, I tried to contact ACLU but their website sucks and is hard to navigate. If you want info about it so you can make a post, let me know!
0 Votes
+ -
No expectation of privacy in anything
frances1@... 10th Sep 2008
All the technology precautions cannot stop the human animal from corrupt behavior. It will continue to happen as it has for thousands of years. I am neither surprised nor horrified as a Countrywide customer. My info is out there in charge cards, medical records, etc., and will be breached again I am sure.
0 Votes
+ -
Corporate terrorism and incompetence
twday@... 10th Sep 2008
Corporate terrorism (the sort that kills 10-20,000 Americans each year by convincing them not to use their health insurance through cohersion and obstruction) and incompetence (such as Countrywide's) is a far worse threat than Osama. The lethargy in Washington that protects these criminals is treasonous. The criminals are obviously terrorists and traitors. Not only should Rebollo be hung for this crime, the executives who "supervised" him should get long jail terms.
First of all, the ex-employee and others who bought the information should be prosecuted to the maximum the law allows. Second, companies like Countrywide should held accountable for any and all costs related to all of the individuals whose confidential data was compromised.

The message that could be sent to these companies should be:
Do this and your company is shut down and out of business, due to your careless security.
0 Votes
+ -
This is all find and dandy...
jskline0@... 10th Sep 2008
But; Fact is that there really are no substantive laws in place for this sort of thing. And the ones that do exist, have absolutely minimal "teeth" to them. This is all about keeping the teeth to a minimum as "Information is King", and there are many that want to get into this playing field.

Congress will not enact any laws to stop this right now because it's not politically feasible. There are too many in Washington that soon will be out of the political realm, and back into the private sector and they want to be able to make a living at something. Since "Information is King" is the thing to do these days, don't push any laws into place to make it hard to get into that.
0 Votes
+ -
Its just to easy to query the db !
pcguy777 10th Sep 2008
spool the data and dump into excel.

you could export a few gigs of data rows in a few minutes.

i guess all this could be stopped if every data cd rom, dvd player, flash drive, and printer were actually monitored.

they should implement a policy or setup a special box, where only on THAT computer, anything larger than lets say 100 Megs, can be copied etc.

However... its the DBA's that could never be controlled unless they were monitored 24/7 in the workplace.
0 Votes
+ -
Actually
High Plains 10th Sep 2008
There are methods to see if a DBA (or anyone else) is accessing sensitive data.

I worked at an alarm monitoring company and found there wre over 500 Access databases on various desktops and servers that had Social Security numbers, credit card numbers, billing address, bank account numbers, etc.

I brought this up to upper management many times but no one had any concern.

When upper managemnt has to serve time for lack of concern then things will change. Maybe...
we need to pass a law in this country that states.

all data purchases of names, phone numberts, ssn's, must be a certified transaction by the government, or a governing body. And if not complied with, YES... even the purchasers of such data can face heavy fines and jail time too. this will curtail the problem a little bit in the US perhaps.
0 Votes
+ -
Some Preemptive Things To Do
QueenMama 10th Sep 2008
I haven't received the letter but since we're Countrywide customers, I'm sure we will.

1. Call your credit card companies and do a "lost or stolen" card option. Get a new CC with new number.

2. Call your bank(s) and get new account numbers for your accounts. I had to do this once when I lost my checkbook and it was not difficult.

There's not much you can do if someone has your social but you can let the "big three" know (Transunion et al) and have a fraud alert put on your account. Someone already mentioned this here. Follow-up the call with written letters to them but taking it a bit further, if you plan to apply for credit or a mortgage, let the credit reporting companies know ahead of time to avoid getting a "fraud alert" on a legitimate application.

The bad thing about something like this is that there is nothing we could have done to avoid it. Most of us protect our private information on-line better than these companies do.

They should NOT be allowed to legitimately sell our personal information AT ALL!

I'm smelling "class action suit" here...and I will be one of the first to join.
0 Votes
+ -
"Sell" the ex-employee's info in retailiation
Boot_Agnostic 10th Sep 2008
of course, it makes little diff in jail, but won't it be a hoot when he gets released to face a mile long track record of bad accounts and bills from some guy who 'stole' or bought his info. Maybe somebody will be able to help them sort it all out.
0 Votes
+ -
Who bought the ifnormation?
hehheh 10th Sep 2008
I want to know who bought my financial information. Is that information available?
Harry
0 Votes
+ -
when changing account numbers...
michael.tindall@... 10th Sep 2008
a further note:

When changing credit card numbers, bank account info, etc, remember also to update any places that you do online billing with, particularly if you have accounts set up for recurring payments. When you change your account info, most of these recurring payments will NOT switch over, even if you are doing on your own bank's website, moreso if you are paying through the creditor's website, and ESPECIALLY if you have an older "ACH" type autopay arrangement.

I work in billing, and of the FEW issues I run into with autopay, this is one of the BIG ones autopay-when borrowers move, they change bank info, but they NEVER remember to update these types of arrangements, which inevitably results in payment reversals due to an INVALID CHECK. When payment the issue isn't caught in time (which is usually...up til then, there was no reason to monitor said account!), it results in late/missing payments, and negative credit reporting...which was the point in the first place!

For any who need it, the REAL link for the annual freebie 3-bureau credit report is:

https://www.annualcreditreport.com


If you use it, it will be helpful to you have a list of your previous addresses on hand, as it will quiz you (a lot) to prove you are who you claim.

DO NOT USE FREECREDITREPORT.COM. IT IS SCAMMY. It requests a credit card, and will sign you up for credit monitoring which will start being automatically billed after a certain period of time (generally after you've forgotten about it).
OK, so they fired the employee and will monitor the mortgage accounts. What about monitoring our credit reports and puting fraud watches on them. What about protecting their customers instead of just trying to look good? I am one of their customers, though not sub-prime. I expect them to step up to the plate and do what ever is necessary for their lapse in security that allowed this to happen.
0 Votes
+ -
Congress already made it "illegal" to use SS numbers for banking or commerce when the system was created..... and this is the way things worked for years......only the Gov used this number.

Then, the banking industry decided to use SS#s, because it was too lazy or cheap to create a system for tracking credit ratings of individuals.

A Senator from New Mexico tried to correct this a few years ago... he was "informed" by the Banking industry, " we can't un-do this!"... it would be too disruptive!... Bull ****!

You can get most information on yourself corrected / changed....(phone#, driver's licence, etc..)

BUT THE SOCIAL SECURITY SYSTEM WAS PURPOSELY DESIGNED, NOT TO ALLOW CHANGE (or re-assigning) SS numbers of individuals....
so .. if the SS # get into the wrong hands.. you are screwed for along time.....
This sort of thing is the pits.

~X~ in CA
What I would liek to know is why it took them a whole month to tell us about this . So in that month our info was out there anyway. And now countrytwide gives us two year free credit monitoring for what the yhave our info already. SS# thats all they need. By the way I just got my latter in mail today. There has to be something we can do. I will talk to my laywer this is an out rage. Eveb if the ydont use our info right now when things cool down bam thats when they will. Pissed off in Jersey.
I have had my info stolen once before I hope not again. I am still getting some things back in order from 5 years ago it never goes away. I did get my letter today also and iam so pissed off.
Countrywide's gall is astounding. In the letter (which I received today) Countrywide generously promises, "We will also work with you to resolve unauthorized transactions on your Countrywide mortgage account related to this incident IF REPORTED TO US IN A TIMELY MANNER." So, if I'm not sufficiently vigilant to spot that money is being stolen from my account with Countrywide and don't tell them promptly, I'm on my own (sucker) even though the theft is due to THEIR failure to spot their own employee's illegal acts over a period of two years??? I can't wait to join the class action
Got mine today. My wife is also on our loan
and Countrywide refuses to protect her with the same offer they extended to me as little as it is.

Sign us up also for the Class Action !!!!!

DonB
0 Votes
+ -
Sign me up too.
smdemo 12th Sep 2008
Got my letter last night. A manager where I work was actually contacted by the FBI about her information a few weeks ago regarding this.

I'm talking to my lawyer before I touch this offer they sent out. I'm afraid that might be their out clause for anyone who activates that "protection".

I'm hoping for a class action here, this is insane.
0 Votes
+ -
Class Action Information....
smdemo 12th Sep 2008
Taken from http://www.finkelsteinthompson.com/new_cases/countrywide.php

On August 18, 2008, Finkelstein Thompson LLP filed a lawsuit seeking class action status against Countrywide Financial Corporation ("Countrywide"), a California-based company. The complaint, filed in the United States District Court for the Central District of California, alleges that Countrywide failed to maintain reasonable and adequate security procedures to protect against the theft of Countrywide customers??? and mortgage applicants' sensitive personal information. The complaint further alleges that as many as 2 million Countrywide customers and mortgage applicants may have had their sensitive personal and financial information, including social security numbers, stolen by a Countrywide employee and sold to unknown entities.

If you are a Countrywide mortgage customer or have previously submitted a mortgage application to Countrywide and wish to discuss your rights and interests in this matter, please contact Karen Marcus in our Washington, D.C. office at 202.337.8000.
I'M A COUNTRYWIDE MORTGAGE HOLDER AND WAS ALSO INFORMED BY MAIL OF THIS ISSUE. WHAT CAN WE DO? THEY ARE ALLOWING COMPLIMENTARY CREDIT MONITORING, ANOTHER SITE ASKING FOR PERSONAL INFORMATION. YOU HAVE TO ASK YOURSELF WHEN WILL THEY HAVE A BREACH IN THEIR ARMOR?? WHAT DO YOU DO?? HELP!
YES TO A CLASS ACTION........WE ARE ALSO COUNTRYWIDE CUSTOMERS HAVE NOT GOTTEN LETTER YET BUT I AM SURE WE WILL. WE HAVE HAD ALOT OF PROBLEMS WITH THEIR FULL SPECTRUM DEPT. ALOT OF LIES I HAVE PAPERWORK TO PROVE IT.
GGAINES0609
0 Votes
+ -
Countrywide's hotline = COLDline!!!
sunnyface 14th Sep 2008
I got the letter last Friday and tried to call the hotline. But I was told the office was closed and to call back during their normal business hours on Monday! That's not HOTLINE!!! So ridiculous! Plus, how in the world that 2-yr credit monitoring service is gonna protect us? Those who took our personal info are not gonna all die in two yrs! I want lifetime protection!!! We should have a class action lawsuit again COUNTRYWIDE!!!
I have spoken to these people and they are putting together a plaintiff list for the class action they filed against Countrywide for this.

I would recommend each of you that got this letter to call the firm to get on the plaintiff list.

Good luck everyone, its time Countrywide paid the price!
0 Votes
+ -
Sign me up
aliciar80 29th Sep 2008
I received the same letter and checked my credit report to find that I was placed in collections for a Sprint cell phone under my name and SS I never owned. Were do i get info on a Class action to get on the plaintiff list??
0 Votes
+ -
Hi all, I will call the law firm mentioned here to take the lawsuit step. The solution from Countrywide is not good at all. The letter sounds to me is carelessness. They are not taking their responsibility at all and they should get consequence. Let's team up and let our voice heard and our rights protected. We are victims and should seek protection by law.
0 Votes
+ -
Im in
IcOpRo 24th Sep 2008
Count me in.. i just got my letter, and i think something needs to be done.
YES A CLASS ACTION SUIT IS DEFINITELY NEEDED OR SETTLEMENT BY GIVING US OUR HOMES AGAIN IF IT HAS BEEN FORECLOSED ON WRONGFULLY.
I RECEIVED THIS LETTER ABOUT A VICTIM OF STOLEN IDENTITY FROM COUNTRYWIDE AND AS PART OF THE SETTLEMENT FREE CREDIT REPORT FOR 2 YEARS FROM ALL 3 CREDIT BUREAUS. THATIS ABSURD. THIS IS SOMETHING WE WILL HAVE TO LIVE UP WITH FOR THE REST OF OUR LIVES. OUR LIVES HAVE BEEN TARNISHED LOSING OUR HOMES AND BAD CREDITS WHICH WILL TAKE A LONG TIME TO FIX. IT IS EASY FOR SOMEONE TO MAKE A FAKE ID OFF OF OUR INFO. HERE IS OUR DILEMMA; WE LOST OR ABOUT TO LOSE OUR HOMES TO FORECLOSURE AND ALSO A VICTIM OF STOLEN IDENTITY, SUBPRIME LOANS VICTIMS, JOB ENDED GOT JOB IN ANOTHER STATE AND DECREASE IN PAY, DECEPTION, MISINFORMED BECAUSE THE SERVICE REPS WERE INEXPERIENCED,ALL OUR FAMILIES INFORMATION SCATTERED ALL OVER COUNTRYWIDE'S DEPARTMENT BECAUSE THEY CLAIMED THEY NEVER RECEIVED OUR FAXED DOCUMENTS SUCH AS TAXES, BANK STATEMENTS, MONTHLY EXPENSES, WAGES ETC. ALSO GAVE US REMOTE PHONE NUMBER TO CALL DALLAS, TEXAS AS OUR FILES WERE TRANSFERRED TO THE HOME RETENTION TEAM, BUT COULD NEVER REACH THEM. WE DESPERATELY NEED HELP FROM COUNTRYWIDE AS WE ARE SCARRED FOR LIFE.
Davis and Davis is another law firm that is doing a class actioin suit against countrywide if you got a letter stating that your info was stoling you should call and join the suit.Call James P. Davis at 716-847-2606

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix