Privacy Maven

Yet another company is victim of a major data breach. This time it’s discount broker TD Ameritrade:

In a press release, TD Ameritrade this morning confirmed reports that it has been informing customers of a potential security breach. The release does not confirm the figure of 6.3 million customers, but a company spokesperson did give that number to reporters in interviews.

The company uncovered the malicious code in one of its databases during an audit, which is part of a stock spam investigation. Sources familiar with the breach said the code is not unlike the code used to steal data on 1.3 million users at Monster.com.

TD Ameritrade has not closed its investigation, but early results indicate that the attack was designed not to penetrate users’ accounts, but to collect addresses for spam campaigns. In addition to names and email addresses, the breached database also contains Social Security numbers, account numbers, and dates of birth, but there is no indication that the thieves stole any of this latter information, the brokerage firm said.

TD Ameritrade, in a competitive environment has sought to distinguish itself among discount brokerage houses, in part by positioning itself as the wise choice of the an independent investor, providing tools and resources for investment decision making. TD Ameritrade has been using veteran actor, Sam Waterston, as its spokesman…

….known, in recent years, for portraying the Executive D.A. in the long-running NBC drama series, Law & Order.

As do all companies confronting the aftermath of a data breach, TD Ameritrade will have to shore up both its security and its public image and Keith Farrell takes TD Ameritrade to task for their response thus far:

If your company network and customer/client information gets hacked or compromised, you have got to be more aggressive — much more aggressive, I think — in confronting an issue which will, fairly or unfairly, be perceived as a failure of your business’s security procedures and technology.

Your communications with your clients and customers, and with the wider public and press through your statements and Web site had better send the message that you are as “annoyed” by the situation as they are — otherwise you’re going to have a bunch of “annoyed and inconvenienced” customers getting angrier by the moment at your spin, and spinning themselves and their business away from your company to somebody else’s.

How this will affect the brokerage industry as a whole, also remains to be seen. Motley Fool points out that companies will need to address these issues:

Brokers do take security seriously. Some discounters like Scottrade have even teamed up with McAfee (NYSE: MFE) to provide a complimentary one-year subscription of McAfee’s virus-zapping software. That’s not the same as protecting a company’s own database integrity, though such measures are obviously a high priority at any institution handling delicate financial information.

Customers will need to beware and stay informed. While such data breaches are out of customer’s hands, they can do much to avoid being victims of phishing scams, if data is breached. The Anti-Phishing Working Group has put together some guidelines.