New Hampshire says FBI probe shows no data breach

24.04.2006
FBI computer forensics analysts have concluded that a suspect password-recovery program found on a New Hampshire government server in February was never activated, leading state officials to say that they don't think any credit or debit card data was stolen from the system.

In addition, a state IT worker who was placed on paid leave while the potential security breach was being investigated has now been cleared to return to work. Douglas Oliver, a Web middleware engineer in the state's Office of Information Technology, said last week that he had received a letter from OIT officials telling him he could start working again on April 25.

Oliver, who in March had identified himself as the unnamed worker put on leave, declined to comment last week about the contents of the reinstatement letter he received. But he said he does plan to go back to work this week.

New Hampshire Attorney General Kelly Ayotte announced the results of the FBI's computer forensics probe on April 14. "As a result of this finding, the state has concluded that it is very unlikely that any credit card or debit card information was accessed by identity thieves," Ayotte said in a statement. A Wide Investigation

The FBI, the U.S. Department of Justice and New Hampshire officials began investigating the potential security breach after Cain & Abel, a password recovery program that can be misused by malicious hackers, was found on the state server during a routine security check.

The New Hampshire Division of Motor Vehicles and the state's Veterans Home were using the server to transmit financial information, and the New Hampshire Liquor Commission used it as a backup for sales transactions. The server held credit and debit card numbers, but no other personal information was stored on it, according to state officials.