Privacy Maven

In recent days, more and more worrisome details are emerging regarding the data breach at TD Ameritrade which has affected its 6.3 million customers. Initial reports were slim on detail, as evidenced in this brief CNN news report.

Now Information Week reports:

An attorney launching a class-action lawsuit against TD Ameritrade Holding alleges the online brokerage knew a hacker had access to a customer database as far back as a year ago.

Information Week indicates the company has responded:

Kim Hillyer, a spokeswoman for Ameritrade, said in an interview that all of the company’s 6.3 million accounts that were opened before July 18 of this year were breached. She would not say when the company first learned that there had been a breach, only offering that “they had been investigating client reports of spam for some time.”

She said in the last few weeks they discovered that malicious code had been embedded in the system. She would not say what part of the system was infected or what kind of code it was. “We have been working with forensics,” she said. “They said they’ve never seen it before.”

Hillyer also said that while the investigation was ongoing, as new customers came on board, the company put their information in the compromised database. “We didn’t know what the cause of the leak was,” she added. “Anyone who opened an account after July 18, though, was not affected by this.”