"As long as security relies on identity, then ID theft becomes an effective way of committing fraud," Schneier adds. "And creating stronger IDs [through biometrics] only makes the problem worse."

Likewise, putting all of your customer information in one central database only heightens the chance that identifying information will be stolen. After all, it’s much easier to break into a large centralized database than small separate databases. And resourceful thieves will always find a way around the toughest security, as Ford and Experian have learned to their chagrin.

To avoid a similar disaster on their turf, CIOs should insist their company’s customer data be kept in separate databases protected by a number of different security measures. And they should push their company to adopt safer business practices that require customers and employees to use a number of different identifiers to gain access to personal data. For retailers, that might mean implementing other business safeguards, such as matching the shipping address with the home address on customers’ credit reports. In the meantime, legislation that bans the use of Social Security numbers and other personal identifiers in instant credit e-mails or letters has already been passed in California and is being considered in other states.

"If you had a dozen IDs and they weren’t linked together, now that would be difficult to steal," Schneier says. "Decentralize, distribute. There is never one answer to security."