Pfizer Inc. says the identities of 17,000 current and former employees were compromised when an employee's spouse installed unauthorized file-sharing software on a company laptop where the data was stored.
Pfizer attorney Bernard Nash said in a letter (.pdf)
Requires Free Membership to View
SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!
Michael S. Mimoso, Editorial Director
to attorneys general in states where affected employees live that names and Social Security numbers were exposed and that the pharmaceutical company will offer them a free year of credit monitoring.
"This software allowed outsiders access to a number of files that included the names and Social Security numbers of the affected employees." Nash said in the letter. "Based on Pfizer's thorough investigation to this point, it appears that the affected employees can be grouped into two categories -- approximately 15,700 who actually had their data accessed and copied, and approximately 1,250 who may have had their data accessed and copied."
Nash's letter included copies of notices being sent to employees.
"Our investigation revealed that certain files containing your data were accessed and copied," the letter to those exposed said. "Based on our investigation to date, we have no reason to believe that any other personally identifiable information was exposed. Also, because the laptop was being used to access the Internet outside the Pfizer network environment, there are no associated risks to any other data systems maintained by Pfizer. We apologize for this incident and sincerely regret any inconvenience that these events and responding to this notice may cause you."
The company recommended employees call 866-274-3891 to get the credit monitoring services.
Connecticut Attorney General Richard Blumenthal (305 Pfizer employees in Connecticut) has asked Pfizer to provide details on whatever security policies were in place before the breach, as well as information about when the breach was discovered and how Pfizer responded. Blumenthal also wants the company to explain how it was able to determine which information was actually exposed. The company has until June 22 to answer those questions.