Michigan Printer takes no credit for this article we are just sharing it.
However the photo's are the property of Michigan Printer
 SACRAMENTO, Calif., Feb. 8, 2010

Copiers: Gold Mines for Identity Theft

Office Copy Machines Store Thousands of Documents on Hard Drives, Are Resold without Being Cleaned

Warning: Picture is the Property of Michigan Printer Repair

(KOVR)  longtext start-->Your doctor, lawyer, or tax preparer could all be unwittingly giving away your very private information. And they're doing it by using copy machines. You may already be a victim and not even know it, reports Tony Lopez of CBS Station KOVR in Sacramento.

The copy machine is an important and seemingly harmless part of our lives. And when it's time to upgrade, the old ones are sometimes sent to e-waste centers for recycling, but usually they wind-up in a wholesale warehouse on the used copier market.

KOVR went to one of two in Sacramento with John Juntunen, an expert on the copy machine business. There were hundreds of machines, shrink wrapped, and ready to shipment.

"You're looking at 15, 20 thousand documents each" Juntunen says - documents that still reside inside. Most copy machines use hard drives to store every document that has been scanned, printed, faxed, or e-mailed.

That electronic file will stay there until someone removes it or new documents push out the oldest ones.

"But this machine here, I can tell it hasn't been cleaned because of the IP-address on it" he says.

Juntunen, and his company Digital Copier Security, specialize in removing the data on those drives; they're hired by companies who know the importance of doing that before getting rid of their copiers.

As easy as tapping the screen, he finds files and is able to print them. One is a confidential child support application.

Like any potential buyer can do here, he connects a computer that allows him to see, download and print whatever is on the hard drive of one of these copiers.

One is a local machine from McCarthy Construction, a major commercial builder. On it, he finds what are clearly marked "confidential" financial statements.

We took it to their Roseville office. A vice president confirmed it is highly confidential, but was confused about how we had gotten it; he didn't want to talk beyond that.

"So here's documents that are stored on the machine" Juntunen shows us. Another machine, more documents -- it's just too easy.

This time we find financial records, including an IRA application for a woman named Marilynne Boyd. Marilynne's husband Harold couldn't believe what we had.

"They have the address, the social security number, they have the date of birth, I mean it's ridiculous" he says while reading the paper we gave him. And it's all in one document.

"It basically becomes an identity thief's dream" says Sean O'Leary. He's the senior analyst for Digital Copier Security. He says laws that prevent the release of private information aren't being enforced when it comes to copier data.

He blames a lack of awareness by authorities and by the businesses themselves.

The moment a copier, rich with files, leaves, let's say, a medical office, patient privacy laws have been violated. "The medical practitioners lost control of that medical file at that point, and that's information that nobody should have" O'Leary says.

Juntunen's office is filled with hundreds of hard drives, many containing thousands of files.

This drive came to us from a customer who bought the used copier from that wholesaler in Sacramento.

He replaced it with a new one but noticed it was loaded with files. On it - a document full of names and numbers, but there was one that caught us by complete surprise - the private information of Caroline Kennedy, the political family scion, socialite and sometime candidate. We dialed Mrs. Kennedy's home number, and her husband Edwin Schlossberg answered.

He had no interest in talking about how their privacy was compromised, and asked us to tear up the paper.

The next day, Mrs. Kennedy's assistant called to tell us "Caroline appreciates us bringing this issue to her attention. She was very surprised to hear about this and was not aware [of the problem]."

That page is one of dozens that were retrieved from a copier recently used by the bay area's Omidyar Networks." It's a philanthropic investment firm and was established by Pierre Omidyar, the founder of E-bay.

Also on that drive - files containing Omidyar business partners: billionaire financier George Soros and Google.

Among the documents there were e-mails, account summaries, budgets, non-disclosure agreements, and the Omidyar's financial contributions. And there was a document that contained the signature of a Google vice president and general counsel.

Right now, no one has a legal responsibility to wipe copier drives clean of potentially damaging data. Warehouses all over America are full of used copy machines containing millions of files just waiting to be mined by unscrupulous criminal profiteers.

Even more worrisome is that an estimated 70 percent of these machines will ultimately land overseas in China, Europe, everywhere. And data-filled hard drives that are salvaged from machines sent to E-waste recyclers; many will wind up for sale online.

"[It's an] issue that's going to have major ramifications. It's going to hit like a ton of bricks when it does hit" warns O'Leary.

Meanwhile, consumers like Harold Boyd and his wife are left, at best, wondering what's next.

"Uh, you and I will sit down and talk about because we don't know what's out there now. I mean this really scares you" Harold tells his wife over the phone.

Omidyar Networks said it appreciated us bringing this issue to their attention, and that it's using built-in security systems to protect the data on its copiers.

There is security software that offers some protection for the data on those hard drives but experts say they're not always used, and they're not 100 percent effective.

Digital Copier Security says its efforts to raise awareness are being met with indifference by authorities, copier dealers and lawmakers.

They say copier companies are reluctant to tell their customers about this document retention issue, because it would likely cost them an extra hundreds of dollars on top of the copiers cost.

Also know that public copiers like those at grocery stores, drug stores, and copy centers all likely have hard drives


Michigan Printer Repair Investigation
Find out what we did to investigate stolen identity
Warning Picture is the property of Michigan Printer Repair


Upon reading this article Michigan Printer Repair thought it would be interesting to try our own investigation.


Here are some steps you can do to minimize the
risk of identity theft.


What You Can Do
Here are some helpful steps that you can take to reduce the risk of exposing
sensitive data to the wrong people.

When purchasing or leasing a new or used copier with a disk drive ensure that the copier includes data protection features such as overwrting and data removal capabalities older copiers dont have this ability but the new ones do remember this is not a free option that the copier sales companies are sharing. 

Ask and see if data security can be installed on your existing copier that may not have it.
 
Before selling or trading in any current machines with data storage, ensure that the hard drives have been thoroughly scrubbed or destroyed Michigan Copier can help with this.

If you aren't sure about what your copier has, or if you need to have the hard drive in your current devices wiped, give us a
call at 586-468-5700 Michigan Copier can help.


 

This article was very interesting I take no credit or did I write this 

Breach Alert: Copiers Are a Risk

Insurer alerts 400,000 after data found on leased copy machines

Howard Anderson, Managing Editor, HealthcareInfoSecurity.com
April 21, 2010

A New York managed care plan has learned an important lesson about leased copy machines: Many contain hard drives that should be scrubbed of information before the copiers are returned.

Affinity Health Plan has notified more than 409,000 customers, clinicians, employees, job applicants and others about a breach related to personal information stored on the hard drives of copiers it returned to a leasing company. The health plan also notified three state agencies plus federal authorities.

Under the HITECH Act’s breach notification rule, breaches affecting more than 500 individuals must be reported to federal authorities and the media within 60 days.

“Like many organizations across the country, we were not aware copy machines contained hard drives that need to be wiped,” says Abenaa Abboa-Offei, senior vice president of customer and community connections at Affinity. The insurer chose to “cast as wide a net as possible out of an abundance of caution” in deciding how many people to notify about the breach as the investigation of what data was on the copiers continues, she adds.

The company has no evidence that any of the personal information on the hard drives, which included Social Security numbers, names and addresses, has been compromised, Abboa-Offei says. The not-for profit insurer serves about 250,000 members in the New York City metropolitan area.

However, in notifying those whose information may have been on the copiers’ hard drives, it advised them to monitor their bank and credit accounts, check their credit reports and place fraud alerts on their credit files as well as “check your explanations of payment for any medical services you did not receive and report anything that does not look right to us or your healthcare providers.”

How the problem was discovered

As part of an investigation, CBS Evening News bought four copy machines from a company that had leased them to four different organizations, including Affinity, and hired a firm to analyze what was on their hard drives. The machine that Affinity had used contained confidential medical information, according to the analysis by Digital Copier Security Inc., Shingle Springs, Calif.

Once the managed care plan learned on March 17 that one of the copiers it returned contained a hard drive that may contain personal information, the insurer contacted the leasing company to retrieve hard drives of other copy machines whose leases have expired.

Most copiers have hard drives

Most copiers used in business settings are leased, “and I’d say 80 percent or more of the machines in use today have at least one hard drive,” says Sean O’Leary, a senior analyst with Digital Copier Security. The hard drives are necessary, he says, because most copiers also now handle printing, faxing, scanning and e-mail.

The information stored on a copier’s hard drive varies widely by manufacturer, O’Leary says. “Some machines more readily capture and store images on the hard drive. Some have a hard drive that has a large part of its capacity used for operating code.”

O’Leary advises healthcare organizations to identify which copiers have hard drives and then take security precautions similar to those used for personal computers. For example, the organization may want to restrict who can use the copier and train staff members on what information should not be copied, scanned or e-mailed using the device.

Before returning a leased copier, the user should remove all information from the hard drive, O’Leary stresses. For example, Digital Copier Security offers a service that involves scrubbing the hard drive, removing it, destroying it, and replacing it with a new drive before the copier is returned.

 Michigan Copier Repair