Joining the club

After a few days of rumors and suspicions, customers of Umpqua Bank got formal notice yesterday that their bank was part of the same data breach that recently happened at the Oregon DMV, and that, yes, their personal information was compromised.

In June 2023, we were notified that a global financial technology service provider used by banks around the world, including Umpqua Bank, was affected by the MOVEit data incident. This incident has involved many government agencies, enterprise corporations and financial institutions. Unfortunately, Umpqua Bank was one of many organizations whose information was involved....

On June 21, our investigation revealed that unauthorized access to the names and social security numbers or tax identification numbers of a segment of consumer and small business customers occurred due to the third-party technology service provider’s use of MOVEit. No bank account information was compromised as a result of the incident, and we are working closely with our service provider to identify and notify any involved consumer or small business customers and provide additional support resources. No information from our commercial customers was involved in the incident.

Like the DMV, Umpqua's not offering any free credit monitoring, at least not yet. But they're full of "protect yourself" ideas, including disabling your electronic access to your Social Security account. Great.

Maybe we need a system in which anyone who collects your data has to pay a tax. The revenue can be used to buy credit protection or insurance for the victims when the IT crowd carelessly lets your uinformation fall into the wrong hands. But of course, consumers would wind up paying that tax indirectly. Don't expect the bank's shareholders to absorb it.

You almost wish some plaintiffs' lawyers would force the DMVs and the Umpquas of the world to shape up. This seems like prime class action territory. But then again, it may be a tough case to make out. If you're an Oregon Umpqua customer, the bank and the DMV can now blame each other for whatever disruption people's lives are about to suffer. No one will ever be able to prove which institution's negligence caused them to lose time, money, or both. Convenient.

At some point, it seems, identity theft will be like Covid. Sooner or later everyone will get it; you just hope it doesn't kill you.