Employer Data Breach Leaves Employees Vulnerable to Identity Theft

This case involves an administrative software company that sells predominantly to small businesses that had experienced a data breach that compromised users personal information, including Social Security numbers, addresses, telephone numbers and dates of birth. It was alleged that lax security measures opened the door to a breach affecting a web-portal that allowed employees to access payroll information remotely. Further, the company took no steps to directly inform them of the breach. Instead, employees learned about the breach through letters from a regulatory agency telling them that their information had been compromised.

Question(s) For Expert Witness

1. Are you able to evaluate the cost of protecting someone's identity over the long-term?

2. How do criminals tend to use stolen personal information?

3. Have you ever published or lectured in this area?

4. Have you ever been sued or arrested?

Expert Witness Response E-061146

I ran the Identity Fraud Task Force at the FBI and spent over 18 years focused on white collar crime. Now, I consult for many big law firms and some mortgage businesses. Over the course of my career, I have seen thieves get much more sophisticated regarding their timing when using stolen information. They will often go dormant and take years to mine/utilize information; that info gets sold over and over again. As for long-term costs, victims like these will need to monitor their credit for the rest of their lives, using a service like LifeLock and subscribing to various credit bureaus. In addition to those costs, there is also a lot of stress and anxiety involved, as well as sheer time required to address the theft. I actively consult now with mortgage company Guaranteed Rate, where I see persistent and prevalent problems with identity theft. I am currently working on 2 similar cases. I am not conflicted and happy to discuss further.