Thursday, June 02, 2005

More identity theft involving debt collectors

Data theft involving four banks could affect 500,000 customers
'This thing's getting bigger and bigger,' says one police officer

News Story by Todd R. Weiss

MAY 18, 2005 (COMPUTERWORLD) - Electronic account records for some 500,000
banking customers at four different banks were allegedly stolen and sold to
collection agencies in a data-theft case that has so far led to criminal charges
against nine people, including seven former bank employees.
Police in Hackensack, N.J., are continuing their investigation into the theft
by a crime ring that apparently accessed the data illegally through the
former bank employees.
According to the U.S. Department of the Treasury, the crime is believed to be
the largest breach of banking security in the U.S., local police said.
Hackensack police Det. Capt. Frank Lomia said the investigation into the
crime ring is moving into a new phase.
"This thing's getting bigger and bigger," Lomia said. "It's still growing.
The banks are uncovering more accounts than we knew about."
The police announced the arrests of the nine suspects on April 28 and charged
them with illegally selling personal identification information stolen from
bank and New Jersey state computer databases.
The police investigation alleges that a company called DRL Associates Inc.
was set up to find individuals and as a collection agency, but was not properly
licensed for those activities by the state.
A Hackensack man, Orazio Lembo, 35, has been charged with one count of
racketeering and eight counts of disclosing data from a database for his role in the
crime ring. Police allege that Lembo used his home as an office for DRL
Associates and that he had hired several upper level bank employees to access data,
including names, account numbers and balances, from the banks.
The bank employees worked for Wachovia Corp., Bank of America Corp., Commerce
Bancorp Inc. and PNC Bank NA. One of the other suspects is a former manager
of the New Jersey Department of Labor.
According to police, after the information was accessed, Lembo and the
company then sold it to more than 40 collection agencies, law firms and others.
Police are now looking into the law firms and collection agencies that allegedly
did business with DRL.
Banking officials at Wachovia are notifying about 14,000 customers of the
possible identify thefts concerns, according to a spokeswoman.
Alexandra Liftman, a spokeswoman for Bank of America, said the bank hasn't
revealed the number of customers who may have been affected by the theft.
Liftman would only say that the bank has communicated so far with 75 customers whose
records were known to be accessed by the crime ring.
No suspicious or unlawful activity or fraud has been reported involving those
accounts, she said.
Fran Durst, a spokeswoman for Wachovia, said Hackensack police have so far
released the names of 300,000 of the 500,000 people whose information may have
been stolen. The Wachovia customers were among the 300,000 names released and
had about 48,000 bank accounts among them, she said. The customers have been
notified of the theft and are being placed on the bank's watch lists for fraud
detection, she said. "There have been no instances of identity theft
attributable to this," Durst said.
Brian Goerke, a spokesman for PNC Bank, said the bank has identified only 12
customers who could be affected by the data theft. "We've gone through the
lists, and those are all the customers on the lists," he said. "That doesn't mean
that their accounts have been tampered with in any way."
A spokesman for Commerce Bank couldn't be reached for comment today.
The ring had operated for more than four years, with Lembo's profits reaching
several million dollars, police said. Lembo, who was also charged with
narcotics, forgery and theft counts, faces up to 130 years in prison and $1.47
million in fines.