SAIC acknowledges risk to military records

The personal information of more than a half million uniformed service members and their families "was placed at risk for potential compromise" when military health care data was being processed by Science Applications International Corp., the company said today.

SAIC did not indicate when the incident took place, but said it fixed the security lapses as soon as it learned of them and began working with customers to mitigate any negative effects.

SAIC said the Army, Navy, Air Force and Homeland Security Department contracts were in connection with Tricare, the online health benefits program for the uniformed services, retirees and their families.

The company said forensic analysis so far has not uncovered any compromise of the personal information ? which could include combinations of names, addresses, Social Security numbers, birth dates, and limited health information in the form of codes.

"However, the possibility cannot be ruled out. SAIC is notifying about 580,000 households, some with more than one affected person," the company said.

The data was stored on a single, SAIC-owned, non-secure server at a small undisclosed company location, and in some cases was transmitted over the Internet in an unencrypted form.

SAIC announced a series of steps it has taken to prevent a recurrence of the data compromise. The company has:

• Conducted a detailed forensic analysis of the server and data, which included assistance from some of the company's and the government's top experts in computer security;
  
• Launched an internal investigation using outside counsel to determine exactly how this security failure occurred and placed a number of employees on administrative leave pending the outcome of the investigation;
  
• Established a company-wide task force to ensure that the company responsibly addresses any adverse impact on the company's customers and any affected individuals; and
  
• Initiated a systematic, companywide assessment to assure that such lapses do not exist elsewhere in the company and determine whether any changes in policy, methods, tools and monitoring are needed to make sure that such a lapse does not recur.