The BBC is reporting that 25 million Britains were exposed to the threat of identity theft when the HM Revenue & Customs (similar to the IRS in the U.S.) lost a CD containing personal data.

Ouch!

This has to be one of the worst data breaches ever, since the CD was not encrypted (just password protected) and the data included:

• Name
• Address
• Date of birth
• Bank account details
• National insurance number

In case you’re not familiar with that last item, it’s similar to the Social Security Number here in the U.S. What else could a potential thief want?

The CD with the data was sent to another HMRC location by a lower level employee via regular mail instead of using an encrypted network connection or some other secure method. The CD never showed up at the other office and officials are now trying to determine if it was stolen or just lost.

“The data lost - bank account numbers, names and addresses - represents a gold mine for the thieves and is much more valuable to them than credit card numbers or taxpayer id numbers,” said Gartner analyst Avivah Litan.

“In fact, in the black market, bank account numbers sell for the highest price, or between $30 and $400 (£15 to £200), which is significantly more than the fifty cents to five dollars that criminals pay for credit cards.”

This disaster has already forced the resignation of HMRC’s chairman - Paul Gray. I’m guessing the employee involved was also “sacked,” as the Brits like to put it. Let’s hope so.

More coverage on the BBC site - Q&A: Child Benefit Records Lost |  Analysis: How Worried Should You Be?

Recently, a new phishing e-mail has been circulating. The e-mail is the IRS asking for donations to help the victims of the California wildfires. The e-mail is a scam. The IRS is not and never will ask for donations, let alone send out an e-mail asking for financial and personal information.

The e-mail seems real enough. It provides links to an IRS website. The website asks for personal and financial information in order to obtain the donation. It seems like a good thing to do. However, do not enter any personal or financial information, the website is not the real IRS website. The information that is asked for is what the scammers use to steal identities, open new lines of credit and ruin peoples’ credit and lives. If that weren’t enough, the links and the e-mail are also thought to contain “malware and other malicious software.”

To protect yourself and help stop the phishing scam the IRS

“urged those who received the scam e-mail to help the IRS shut down the operation by forwarding it to phishing@irs.gov, using instructions found in “how to protect yourself from suspicious e-mails or phishing schemes” on the genuine IRS Web site, http://www.irs.gov.”

On a happier note, the IRS is doing their part to help the wildfire victims. They are extending payment and tax return filing deadlines for victims.

“As California taxpayers start the recovery process, the last thing they should worry about is meeting a tax deadline,” said IRS Acting Commissioner Linda Stiff. “The IRS offers many resources for disaster victims online at IRS.gov, over the phone and in person.”

If you would like to donate to the victims there are several ways in which you can. The LA Times wrote an article with several suggestions of how to help the wildfire victims.

Read the AP’s article for all the details of the e-mail scam.