Another Data Breach, Another Thin Attempt to Make Us Feel Safe

When Merrill Lynch (NYSE: MER) told employees last week that a computer device containing personal data about them had been stolen from its New Jersey office, the brokerage did like many, many companies before it. Merrill said, in essence, “But don’t worry about it.”

“We have no reason to believe at this point that anyone has accessed the protected information,” a company spokesman told me this week. He wouldn’t say how many people may be affected, though CNBC reported it’s 33,000 and among the personal information now compromised are Social Security numbers.

Why doesn’t Merrill have a reason to believe the data has been accessed? The spokesman declined to explain. 

Did it analyze network logs for signs of unauthorized access that could be tied to the stolen information? Did it recover the stolen device and test it, however imperfect those tests actually are, to unearth the thief’s digital tracks while he had the device? Did the company contact all the financial institutions used by the affected employee to analyze any unusual account activity?

Did Merrill gaze into its Magic 8-Ball to ask, “Did a dastardly ne’er do-well use our employees’ data for evil?” (Shake, shake, shake.) Answer revealed: “My sources say no.”

Merrill isn’t the first company, and won’t be the last, to simultaneously acknowledge a data breach and assure that the information hasn’t been compromised. Pfizer did it in May when it notified New Hampshire authorities that data on 17,000 current and former employees was made vulnerable when the spouse of one employee downloaded file-sharing software onto a Pfizer laptop. Caterpillar said it in April when it said a company laptop was stolen, containing employee data. Neiman Marcus, Boeing and Starbucks have all said it. Both Privacy Rights Clearinghouse and attrition.org keep careful track of data breaches and companies’ responses to them. 

But the truth is that by virtue of the information being stolen, it’s been compromised. And no one can really know what happens to those Social Security numbers, names, addresses, account numbers, medical records and whatever else has been exposed in various breaches until months or years later — after it’s bought and sold and bought and sold again, and perhaps used to set up fake identities. Crime takes time. 

Merrill, which is working with New

Jersey police on the theft, has offered free credit monitoring to the employees whose data is missing. That’s a good thing. And thank goodness for state disclosure laws that mandate companies reveal at least some data breaches.  How a company handles post-breach clean-up save or sink its reputation.  One suggestion: Please stop issuing thin assurances that “to your knowledge” nothing bad has happened to stolen data. Those statements just make you look silly.