Email Security Breach

The company where I am contracting experienced a security breach today. This morning when I got into work, there was a posting on the company news dashboard about a Virus Alert. When I opened my email, there were a handful of files with .zip attachments and the icky feel of spam. For example, "cyber thomas" sent me a picture, and "serv" informed me of "Security risk found in message 'Mail server report.'" with the following text:

Mail server report.

Our firewall determined the e-mails containing worm copies are being sent from your computer.

Nowadays it happens from many computers, because this is a new virus type (Network Worms).


Using the new bug in the Windows, these viruses infect the computer unnoticeably.
After the penetrating into the computer the virus harvests all the e-mail addresses and sends the copies of itself to these e-mail
addresses

Please install updates for worm elimination and your computer restoring.

Best regards,
Customers support service

Not very likely that I was going to install the updates for my computer restoring.

But I was curious as to how the breach occured and asked around a bit to try and understand how this happened. The company uses Lotus Notes and requires remote users to connect to the network via VPN to access the Domino server. Idle thoughts include someone on the sales force on a public wireless network somehow had their address book copied. Another possibility is a disgruntled employee or contractor. Of course, a classic worm could be the culprit. Something that was opened internally and walked through the address book.

So, I googled around to see what I can find. One of the more shocking discoveries was at www.privacyrights.org, which has a list of data breaches from the last 20 months that have been disclosed by various companies and news organizations.

What is shocking about this is the number of records that have been breached, recalling this cannot be a full list since there are doubtlessly companies that do not report some breaches. The number -- are you ready? -- is nearly 94 million records containing sensitive personal information. Holy Servers, Batman!

It's no surprise then that millions of folks have their identity ursuped each year, now is it?