Computer stolen from VA subcontractor Unisys

|Originally posted at 1:11 p.m.; updated at 4:59 p.m.|

The Veterans Affairs Department today confirmed that a subcontractor, Unisys Corp., had informed the department that a desktop computer containing sensitive personal information of veterans is missing from the company's offices. It is the second VA data compromise in three months.

Unisys said the desktop computer contained billing records with information for veterans who sought treatment at two VA medical centers, one in Philadelphia and one in Pittsburgh. The information includes names, address, Social Security numbers and dates of birth. It does not include personal financial information.

"The data were used only for insurance collections management purposes and may include insurance carrier and billing information as well as claims data with some medical information," Unisys said in a statement.

Unisys was hired to assist in insurance collections for VA's medical centers in Pittsburgh and Philadelphia.

"VA's inspector general, the FBI and local law enforcement are conducting a thorough investigation of this matter," said VA secretary James Nicholson.

Earlier, the offices of New Jersey Republican Reps. Frank LoBiondo and Jim Saxton confirmed that local, state and federal law enforcement, including the FBI, are investigating the theft of a desktop computer from the contractor's office. VA notified the congressmen's offices Friday evening that information for veterans living in the Pittsburgh, Philadelphia and Southern New Jersey areas might be compromised.

Unisys notified VA Aug. 3 that the computer was missing from its Reston, Va., offices. VA immediately dispatched a team to Unisys to assist in the search for the missing computer and to help determine the precise nature of the information it may have contained.

Unisys had observed security controls, but there was not a requirement to encrypt the data, said Unisys spokeswoman Lisa Meyer.

"The building and floor where the computer was located require security protocols for physical access. Log-in and password protocols also were required to access the data, which were stored in a database on the computer," she said.

"Unisys takes very seriously its responsibility to safeguard individuals' personal information and shares the concerns this incident will cause," the company said. It will also work with VA regarding the notification of potentially affected veterans and the offer of credit monitoring.

While the investigation is in an early stage, VA believes the records involved are limited to people who received treatment at the two Pennsylvania medical centers during the past four years.

Initial estimates indicate the desktop contained information on approximately 5,000 patients treated at Philadelphia, approximately 11,000 patients treated at Pittsburgh and approximately 2,000 deceased patients. VA is also investigating the possibility the computer may have contained information on approximately 20,000 other people who received care through the Pittsburgh medical center.

Investigators are working on this incident with the full cooperation of Unisys, VA said. The department is also working with Unisys regarding the offer of credit monitoring and individual notifications to those who may be affected.

Upon learning the computer was missing, VA personnel took immediate steps to notify the appropriate senior VA leadership, including the secretary and deputy secretary, appropriate congressional offices and committees, VA's Office of the Inspector General and other law enforcement authorities, including the FBI and the Department of Homeland Security's Computer Emergency Response Team.

"VA is making progress to reform its information technology and cybersecurity procedures, but this report of a missing computer at a subcontractor's secure building underscores the complexity of the work ahead as we establish VA as a leader in data and information security," Nicholson said.

This latest data breach follows another that occurred in May, when thieves stole a laptop and hard drive that contained the personal data of millions of veterans and active duty service members from the home of a VA employee. Arrests were made in that case over the weekend.

The laptop and hard drive, which were stolen May 3 and recovered in late June, contained the names, birth dates and Social Security numbers of what was believed to be up to 26 million veterans and service members.

Nicholson received harsh criticism for the department's lax security and the three weeks it took to report it publicly. As a result of the theft, Nicholson has begun to strengthen and centralize information security.

The Office of Management and Budget responded to data breaches at VA and several other agencies with guidance that emphasizes existing and some new IT security provisions aimed at protecting data outside of department premises and accelerating reporting of data compromises. OMB directed agencies to have those in place by today.

Lawmakers also crafted legislation to tighten agencies' data security. The House Veterans Affairs committee has sent to the full House for consideration the Veterans Identity and Credit Security Act. House Government Reform Committee chairman Tom Davis (R-Va.) introduced the Federal Agency Data Breach Notification Act, which calls for the agency CIO to enforce data breach policies and defines sensitive personal information as any information contained in a record.

With yet another data compromise, House Veterans' Affairs Chairman Steve Buyer (R-Ind.) urged the House to pass Veterans Identity and Credit Security Act, H.R. 5835.

"This is a frustrating reminder of the urgent need for action on the security bill to reform data security and IT management within VA," he said.

Last weekend, Montgomery County, Md., police charged teen-agers Jesus Pineda and Christian Montano, both of Rockville, Md., in the VA data theft with first-degree burglary and theft over $500. Montano also was charged with conspiracy to commit first-degree burglary and conspiracy to commit theft over $500. A juvenile already in custody on an unrelated charge is also a suspect in the crime, the police said.

Mary Mosquera and Patience Wait are staff writers for Washington Technology's sister publication, Government Computer News.