Data Breach At Gunpoint: Kmart Armed Robber Walks Away With Sensitive Pharmacy Records

It is IT's worst nightmare: What if an armed violent criminal hits the store and empties the safe and, perhaps unintentionally, takes our unencrypted data backup? It happened to Kmart at its store in Little Rock, Ark., according to a statement parent company Sears (NASDAQ:SHLD) issued Monday (April 22).

The statement, which came more than a month after the March 17 armed robbery, was forced by rules from the Health Insurance Portability and Accountability Act (HIPAA). When a breach impacts more than 500 state residents—Kmart is quoted by The Chicago Tribune saying that 788 Kmart shoppers were impacted—the retailer has 60 days to announce it.

The intruder confronted the store's assistant manager, who had just closed the store for the night, when he went into the parking lot to get to his car. The thief slashed one of the assistant manager's car tires so that he would be occupied when the thief pointed a silver gun at him and ordered him to open the store and to then open the safe, according to the police report. The thief helped himself to the contents, including about $6,000 in cash and that day's backup disk.

The disk, which was unencrypted and apparently not password-protected, included the full names, addresses, dates of birth, prescription numbers, prescribers, insurance cardholder IDs and drug names for some 788 customers, according to Sears. "Certain prescriptions also contained the customer's social security number," said the Sears statement.

The Tribune story also quoted Sears spokesperson Shannelle Armstrong-Fowler as saying something curious. "Kmart officials said the chance of the perpetrators accessing customer private information is 'slim to none, because you would need to know what software package and have that software package to could translate it [the information],' " said Armstrong-Fowler.

Although it's true that a specialized corporate backup system—such as the one that pharmacies such as Kmart's would likely use—would be harder for most run-of-the-mill armed robbers to access than a consumer backup system, it would not likely be that difficult to extract much of the content. A hex dump utility could likely extract much of that content, which is why strong encryption (heck, in this case, any encryption would have been nice) is critical when dealing with sensitive data. A well-built safe is only protection until a hoodlum shows up with a poorly-built gun. (The only way to stop a bad guy with a gun is a good guy with a 256-bit encryption key.)  

For more:

- See The Chicago Tribune story

Related stories:

Sears, KMart Outage Was To Prep For The Holidays
Judge Rules That A Large Data Breach Is Not Proof Of Inadequate Security
After Seven Months, Why Does The PCI Council Yet To Have Anyone P2PE Validated?