The Cord Blood Registry, the world’s largest stem cell bank based in California, has suffered a data breach leading to the theft of 300,000 client records. This could prove very costly to the company, as current research published by the Ponemon Institute reports that the average cost per lost record to a business is now at $214.
The theft occurred in December last year outside a data centre in San Francisco when a CBR employee’s car was broken into. The personal data of the clients was stored on a laptop and on LTO4 tapes, to make matters worse, all the data wasn’t encrypted. The report published by Networkworld, says that although letters have been sent out to all clients affected by the data breach, some only received their letters this month.
The CBR’s director of corporate communications, Kathy Engle states that no reports of identity theft due to the theft have yet to be reported. She goes on to say “The tapes may have contained personal client data of adults (credit card numbers, driver’s license numbers or social security numbers); nothing on children and no health information at all,”
One letter sent to a client was an IT professional who used to work for EMC who said “What on earth are LTO4 tapes doing in a trunk with all this ‘secure’ information? CBR hasn’t described what was actually stolen either. I’m frustrated.”
The CBR stores 350,000 blood collections from umbilical cords which is a rich source in stem cells helping with future medical treatments. The CBR charges over $2000 per client for signing up to the storage with ongoing fees of $125 per year. Working with the Ponemon Institutes figures, this data breach could set the company back 64.2 million dollars and cause irreparable damage to the company’s reputation.
