Double-sided printing data ballsup leaves insurance giant Chubb with egg on its face Insurer Chubb scored a privacy own goal recently when a double-sided printing error on bulk mailers sent to customers about a policy document change contained a stranger's personal details on one side of the sheet. The single A4 page included names, addresses and policy document numbers in addition to the policy update and was …
At one time, we all had to learn the Lord's Prayer by rote. Maybe nowadays schoolkids should learn the following prayer:
Our Customers, who art worldwide,
We take the protection of your personal data very seriously,
and we are committed to protecting the privacy and security of all the data entrusted to us,
For ever and ever,
Amen
I work on the "apology is not a solution" basis.
Saying "Sorry" doesn't fix it. Tell me why it happened, what you've been doing to stop it happening before, and what you're going to do to stop it happening in the future.
Because if the answer is: "We pressed the wrong button in Word, we've never imagined it could be a problem for a multi-national company to use Word mail-merge and not check the 'double-sided' option on our major print runs, and we'll slap the wrists of the intern involved but the next run will probably be done by a different guy anyway", then I have absolutely no interest in retaining your services.
Rail companies do this all the time. Don't apologise for it being late. Stop it being late. Even if that means it still gets there at 8:08 and waits for 15 minutes before leaving, but at least we *know* that because you just re-time the route accordingly and tell us what to expect.
You wanna convince me... do a full post-mortem, publicise the results (with suitable redaction), highlight the weaknesses you *had* and then post the plan and timeline to fix those weaknesses *and others of the same type* that you can imagine now you've sat and thought about it. Then I might accept the apology attached to that document.
I can imagine someone forgetting to turn off double sided printing, but how did they manage to put so many in envelopes and send them to customers without anyone noticing at any point that they had two different letters on one piece of paper?
Surely multiple people must have held the paper in their hands and looked at it?
<quote>Surely multiple people must have held the paper in their hands and looked at it?</quote>
Not necessarily so.
The entire print, fold (or 'mutilate') and envelope insertion process could be automated, running without human intervention once the print job was fired off.
"The entire print, fold (or 'mutilate') and envelope insertion process could be automated, running without human intervention once the print job was fired off."
Yep, and they may not have physically done the print run themselves. So either inhouse automated insertion, or send the data to a 3rd party for them to do it.
Saw GE's printing setup many years ago which was used for their own stuff as well as third parties. Very impressive to witness, fully automated printing, folding, envelope stuffing, and even sorting (on massive volume if you pre-sort the letters into postal regions you can reduce the postal cost per letter).
"I wonder whether they noticed the bill was half what they expected before the first complaint arrived."
It was probably outsourced. The outsourcer will have quoted for n print & stuff operation and been pleasantly surprised when the stuff operation came to n/2 but still billed the quoted price.
Exactly. If the national electricity supplier's billing department we visited as students a full twenty years ago could do it then, your friendly neighbourhood grandma should be able to do the same today between tea breaks. As a funny aside, the highest security tech on site was the little sealed and padlocked device that was authorized to print and count the "delivery paid for" ersatz-stamps on all those envelopes...
Because the printer the job was sent to puts the letters in envelopes and puts the envelopes in a mail sack, and all the staff there need to do is replace the mail sack when it fills up, and take the full sacks to the loading bay to be collected.
I think they should have sent each letter as a separate print job, or placed the appropriate barcode at the side of the page to tell the printer it was a new letter.
"Because if the answer is: "We pressed the wrong button in Word, we've never imagined it could be a problem for a multi-national company to use Word mail-merge and not check the 'double-sided' option on our major print runs, and we'll slap the wrists of the intern involved but the next run will probably be done by a different guy anyway", then I have absolutely no interest in retaining your services."
This obviously was a mistake and as Phuzz added, a series of mistakes. Creating the document and printing is done by multiple people except in small companies.
It however appears to be in Chubb's best interest NOT to publish the post-mortem since the reason is probably something on the lines of what you wrote there, and admitting this schoolboy error would result in not retaining a customer such as you and many others.
Unofrtunately these kind of useless blanket replies do the least harm and most people - unless direcly harmed by the letter - will forget this episode in days. If however they did the noble thing, people could remember the company whose mailing division is not to be trusted, they'd receive ridicule for a long time, with funny memes created, commercial jingles re-worded etc.
It however appears to be in Chubb's best interest NOT to publish the post-mortem since the reason is probably something on the lines of what you wrote there, and admitting this schoolboy error would result in not retaining a customer such as you and many others.
The catch is: "Where do you go then?" Seems every insurance company is getting hit by stupidiy, usually hacked but this one is different. Still... they've all (for the most part) been named and shamed and with no apparent flashback to the bottom line or customer numbers.
I used to catch a train from Paddington on Friday nights back down to Devon, after time a pattern emerged.
It was was the 18.31 from Swansea 10 minutes late, I & a few others who had cottoned onto the schedule, used to wait on the bridge over the stations, watch it being cleaned & then get on find our reserved seats , get DVD player & beer out & settled in before the rest of the herd had been let on to the platform via the gates on the main concourse.
This post has been deleted by its author
Well, it certainly does seem like a prayer.
- Say the prayers with eveyone else during mass
- Ignore it once you get out of the church
- IF caught, Go to confessional and explain your sins in private and put a fiver in the collection bin
- ELSE carry on as if nothing happened
- ...
- PROFIT
Our data, which is in the cloud.
Hallowed be thy password digests. Thy security come, by obscurity as it is by encryption.
Give us this day our daily breach reports and forgive us ours, as we forgive those whose breaches are against us.
Lead us not unto the ICO, but deliver us from legislation.
For thine is the schema, the hardware and the software.
For ever and ever. Amen.
The firm holds the security of this information in such high regard that it urged customers to simply "discard this previous letter and refer to this version only, which details important information below about core for insured persons".
I take it thats discard by securely shredding or burning?
You may fairly safely assume that the bulk mailing is outsourced. Its been years since I've worked anywhere that prints locally anything other than one-off letters.
I have almost never seen any bulk output in its physical form, its all overcomplicated with "inserts" and sorting for cheaper posting etc. This however is the source of the problem as its impossible to test in that setup.
Well , this has obviously come about from a new "save paper / double sided by default" initiative - very admirable.
Don't give them ideas: "Read the side with your name on it. When done, mail it to the person on the other side. Thank you for helping us save trees and printing costs."
Thats nothing compared to the amount of misaddressed emails from them that end up at my primary domain....
(I am a descendent of the company founders and operate a chubb based domain for the benefit of my family, so no domain squatting here..., also gifts me with a terrible chat up line: "i bet my name is on your front door, no? then its on your backdoor" ;) )
Literally every day i receive dozens of fire extinguisher test reports, insurance documents, security system commissioning docs etc. I have repeatedly tried to reach out to their security people but yet to get a reply, kinda sad when you think that security is meant to be their thing, so now all the alarm codes, sensor coverage reports etc, get purged every week from the catch all account
Just the responsible thing to do, what distresses me more is why stuff like that is not sent encrypted, or even in a pass word protected zip to ya know put a speed bump in the way of casual observers... ho hum
At one point i even went as far as having an automated reply of "this is not the domain you are looking for", all that did was make them double down on the attempts to send it to the wrong address
"reach out to their security people but yet to get a reply, kinda sad when you think that security is meant to be their thing, "
I dont know why but this is winding me up!
is this all coming from subcontracted installers/testers?
Surely the missing docs would alert them to an issue?
If i have a chubb system installed i'd be bothered that
a) my paper work is missing
b) you've got it!
could you not send an automatic reply to either the chief, or the accounts department saying .
"More Chubb.co confidential information received, storage charge for this data is £xx pm"
"At one point i even went as far as having an automated reply of "this is not the domain you are looking for", all that did was make them double down on the attempts to send it to the wrong address"
I had a similar problem with a finance company whose fax number was the same as mine - in another area code. Complaining made it worse.
The annoying faxes on the voice line only stopped when we plugged in a fax and started faxing back applications with "REJECTED" written across them in 2-inch high letters. I'd imagine that someone started getting an earful in head office.
How about starting a blog/social media account and feeding the stuff straight into that? Email them one last time reminding them of previous communications and tell them you're going to do that so when their lawyers come storming out you can point them to that and tell them to go back and tell their clients that they should have cleaned up their act long ago.
three things
1) social media, i do not
2) Would be wide open to civil suits
3) As this is very sensitive information all i would do is hurt the customers (im talking sheltered housing, old folks homes, hospitals, banks, small businesses etc.) who have done nothing wrong than assume the security company gave a flying f about digital security, and even then the core of the problem seems to be US set policy from the parent company
"assume the security company gave a flying f about digital security,"
Maybe more practical to spend a free half half to work out who some of these reports are referring to, and simply forward the info to the relevant people with a covering message. That might start a useful ball rolling.
"Would be wide open to civil suits"
Not really. you're operating an email to bulletin board gateway and there's a very simple way to prevent sensitive information showing up on it - don't mail it in.
As for #3 - the civil suits will start flying and they won't be directed at you.
You might also try contacting the ICO if there's personal information on what's coming through and the company is UK based.
Maybe not directly but don't need the hassle of getting dragged into anything, frankly it caused enough hassle last time I got a threatening letter disputing my right to the domain even though I have had it registered since the mid 90s for me to consider shutting the service down. Thankfully the reply of "gtfo its my surname kind regards Mr chubb" saw that one off at the pass...
Having worked in an office next to the local Chubb Fire Security division none of this surprises me. I had regular arguments with them about which air con control was for their office and which was for my office. I used to work in their office but they still would not believe me despite demonstrating that the AC on which they were turning the temperature up was not blowing any air in their office.
I could but as I mentioned I mainly use the domain for family email addresses, and as I'm extended family tech support (wearing the "I will not fix your computer" t shirt to family gatherings didn't have intended effect) it's much easier to find missing emails for great aunty Doris whose fat fingered friends have forwarded some chod to drois@....
There are levels of security for items mailed. The lowest is a post card, then in a plain envelope, then in a security envelope, then add a security insert, double envelope with inner security sealed, the possibilities are endless before you even upgrade the trustworthyness of the carrier. Things were sent securely before they were digital.
This mail run should have used the security envelope. I say should because even things which were secured prior to PCs on every desk are now not and not just in the PCs.
I have received a piece of mail which should have been in a security envelope but wasn't... It was the information I needed to login to the secure patient portal being sent via a separate channel for security. It had the password and username and patient name and URL of the portal all in a plain windowed envelope. I complained to all the right places but to no avail. They are now seeing the advantages of going digital but still getting it wrong. By security policy, they now are rejecting access from VPN. So now I am forced to choose the digital equivalent of the plain windowed envelope or the actual plain windowed envelope.
For my sins I occasionally use Adobe to print PDF files.
I have a double sided printer.
I recently discovered that if I do a print run of 20 one page single sided documents it helpfully saves paper by printing double sided.
You have to set it to single sided printing in the printer properties.
Still, Adobe.........
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
