Data theft 2nd loss this year

Credit card numbers lost earlier at airport

April M. Washington, Rocky Mountain News

Published November 3, 2006 at midnight

Text size

More Local News

The theft of a desktop computer that exposed thousands of Coloradans to identity theft marks the second time the private contractor has lost control of personal information on Coloradans in its care.

Earlier this year, a backup data tape was stolen from Affiliated Computer Services Inc., compromising credit card numbers used in transactions at Denver International Airport.

Dallas-based ACS, one of the largest outsourcing companies in the nation, processes child support payments for the Colorado Department of Human Services for $5.5 million a year.

The Colorado incidents are among several security breaches at ACS in the past year.

In one case in August, personal information on about 32,000 student loan recipients was exposed to other users of a federal Web site because of ACS software glitch. And last May, two computers containing personal information on Motorola employees were stolen from ACS's Chicago office.

The problems have one lawmaker questioning the company's ability to protect sensitive information.

"This is clearly problematic," said Rep. Terrance Carroll, D-Denver. "If a company can't protect sensitive information in its care, the state needs to seriously look at whether we should be doing the business with this contractor. The answer is no."

But Kevin Lightfoot, an ACS spokesman, said the company takes the protection of private information seriously.

The Oct. 13 theft from a Denver office of a desktop computer containing child support data has no connection with the DIA incident or others elsewhere, he said.

The office where the theft occurred has surveillance cameras, and entry to the facility required the use of a password.

"We don't consider these incidents breaches in security," Lightfood said. "These are criminal acts of theft. A breach is when someone has hacked into your system.

The company has sent letters to at least 500,000 people involved in Colorado child support cases to let them know they may be exposed to identity theft.

The company also is notifying residents who were listed on Colorado's new-hires registry, which is operated in conjunction with child support-related cases.

Steve Synder, a DIA spokesman, said there has been no indication that anyone's credit card information was compromised in the theft of the backup data tape.

The airport put tighter security controls in place since then and ACS is no longer allowed to store credit card information on any systems at DIA, Snyder said.

Liz McDonough, of the Department of Human Services, said the theft of ACS's computer marks the first breach in security by the company since it was hired in 1999.

Subscribe to the Rocky Mountain News