Data breaches: is anyone safe?

Another month, another data breach by a major U.S. company. Wait--make that several U.S. companies.

Those who haven't been exposed to possible ID theft by their bank, credit card company, or favorite store, should consider themselves extremely lucky thus far.

In April, Time Warner said it lost computer backup tapes containing sensitive data, including the names and Social Security numbers of 600,000 current and former employees, their dependents and beneficiaries, and individuals who have provided services for the company. Time Warner says the data, stored on 40 tapes, disappeared more than one month ago while being shipped to an offsite storage center.

Also in April, DSW Shoe Warehouse admitted that a data breach--suffered when thieves accessed one of its databases and stole credit card numbers and names--exposed 1.4 million customers, 10 times more than the company had estimated in March. The thefts happened at 108 stores in 25 states between November and February. Besides the credit card numbers, the thieves obtained driver's license numbers and checking account numbers from 96,000 transactions involving checks, the company said. Customer names, addresses, and Social Security numbers were not stolen, it said.

In May, what is perhaps the biggest security breach to date in the banking industry affected customers of several large U.S. banks. This time, personal information was sold by employees. Bank of America Corp. and Wachovia Corp. are among the banks notifying more than 670,000 customers that account information was stolen. Hackensack, N.J., police estimate the number of accounts breached may top 1 million.

Account information on the customers was illegally sold by bank employees to a man identified as Orazio Lembo, whom police said was doing business by illegally posing as a bogus collection agency. Customer account numbers and balances were allegedly sold to Lembo, who then sold the information to collection agencies, the Hackensack police department said in a statement. Nine people have been arrested and charged, including seven bank employees and Lembo, who had employed upper-level bank employees to access and identify individual accounts in their respective banks. That information was then sold to his clients, which included more than 40 law firms and collection agencies. CNN reported that Lembo paid $10 a name, convincing the bank employees that they would not get caught. Police estimate that Lembo made several million dollars over the past four years and that his informants each made tens of thousands of dollars in the scheme.

Other banks affected by the theft ring were Commerce Bancorp, based in Cherry Hill, N.J., and PNC Financial Services Group Inc.