Archive

Archive for the ‘Breaches, Public Disclosure, Etc’ Category

TDAmeritrade Class Action Lawsuit

June 23rd, 2009 Justin Kallhoff No comments

I know this is old news, but I got a big chuckle when I got a post card in the mail today from TDAmeritrade:

To All Account Holders Or Prospective Account Holders Who Provided PHYSICAL OR EMAIL ADDRESSES TO TD AMERITRADE

This was my notice of the class action lawsuit in lieu of their little data breach.

In all of the explanation in fine print (designed so that fewer people actually read it I’m sure) they ensure me via one bold line:

The consultant conducted four analyses since August 2007 and found no evidence of identity theft resulting from the data breach.

Another good line is  “The Company denies any liability in the matter.” Big Shocker.

So disregard the whole point that you were breached.  Or let’s not.

A 2.5 billion a year financial institution, holding 225 BILLION DOLLARS of customer’s money.  Despite all that wealth and magnitude, you couldn’t protect my data.  Nevermind that my inbox was flooded with targeted phishing attacks sent to (this is the best part) a completely unique address I only supplied to TDAmeritrade.  I’ll be the first “Account Holder” to stand up and say I’d like to raise the BS flag on the “alleged” language in my postcard and change it to confirmed.

I guess they should have listened to the customer from Nebraska that took the time out of his busy day to bring this matter to their attention a year ago.  I tried to tell them, I repeatedly tried to explain, I sent emails, I tried to do my fair share to alert them.  What did I get in return?  I got the scripted response, “We’re aware of the problem and are working to correct it.  We understand your concern and apologize for any inconvenience.”  Oh and based on the fine print on my postcard I may get a free year of an Internet security product.   Thanks, but no thanks.  I think I will start to post blogs about every organization that I believe to be compromised, well at least the ones that give me the scripted response that is…..

Sadly my team at Infogressive could have prevented this incident for far less cost with so much less reputational loss.  I think a big, “I told you so” is in order here.  I know Ameritrade has some smart people that work there, I personally know some of them.  I hope that they are listening to them more intently these days.  Psssst, hey you may want to implement best practices as a 2.5 billion dollar a year bank, just a thought, just my $.02.