According to a message posted on the department's Web site on Monday, one of the department's data analysts violated procedure by taking home the information without authorization. The information was stored on a laptop, according to Avivah Litan, a security analyst for research firm Gartner. Law enforcement agencies have launched a search, the department said.
The message also said that besides Social Security numbers, data lost included dates of birth for veterans and some of their wives. The employee whose house was robbed was placed on administrative leave.
The number of Social Security numbers involved means this could be one of the largest thefts of SSNs ever. But in no way is the theft of Social Security numbers uncommon. Just this month, Ohio University announced that data thieves broke into three of the school's computer servers and accessed 200,000 Social Security numbers belonging to students and alumni.
Others who have suffered the loss of such information are the Metropolitan State College in Denver, the U.S. Department of Agriculture, and Los Angeles' Department of Social Services, according to the Privacy Rights Clearinghouse.
Because of the growing number of Social Security number thefts, Gartner has advised businesses to stop relying on SSNs as "the ultimate identifier" of individuals, says Litan, the firm's security analyst.
"If you add up all these thefts, we estimate that one out of seven Social Security numbers is in criminal hands," Litan said. "Or the numbers are in the hands of illegal immigrants or are sitting somewhere in a chat room. You can't rely on them anymore."
The good news for Veterans Affairs is that the crooks may not know what they have.
"It is possible that (the thieves) remain unaware of the information which they posses or of how to make use of it," Veterans Affairs said on the Web site.
Gartner's Litan agrees. Studies have shown that thefts of computers storing sensitive data have resulted in only a small percentage of identity theft, she says. And she added that information on millions of veterans would not necessarily yield much loot.
"Frankly, veterans don't have a lot of money," Litan said. "They aren't typically wealthy people. Criminals aren't going to be taking out 26 million loans (in the names of the veterans whose information was stolen). That's a lot of information, and the thieves have time constraints just like everybody else. They want information on the wealthiest individuals."
