Idaho utility hard drives, with data, turn up on eBay

04.05.2006
Anybody with five bucks and a little patience may be able to score sensitive corporate or customer data on eBay.

If your organization has engaged in the common practice of disk drive recycling -- selling unneeded disk drives directly or through a service -- company data might wind up for sale on eBay, even if the drives have been wiped first.

Idaho Power Co. discovered that possibility last week as it scrambled to track down company disk drives that had been sold on eBay without having been scrubbed first. The Boise-based utility serves approximately 460,000 customers in the southern part of Idaho and in eastern Oregon.

Data on the drives, which had been used in servers, contained proprietary company information such as memos, correspondence with some customers and confidential employee information, the company said.

Idaho Power had recycled approximately 230 SCSI drives -- a year's worth of updates -- through a single salvage vendor, Grant Korth, which then sold 84 of the drives to 12 parties through eBay. The company recovered 146 of the drives from the vendor. It also got assurances from 10 of the 12 parties that bought them on eBay that either the drives would be returned or the data on them would not be saved or distributed. The other two drives are still being tracked down; An Idaho Power spokesman did not know what information was on them.

Korth, of Nampa, Id., refused to comment. In the meantime, Idaho Power has launched an independent investigation through Blank Law Associates in Seattle into why its policy on scrubbing drives was not followed. Typically, Idaho Power was to have either physically destroyed the drives or scrubbed them to Department of Defense standards -- which means either degaussing them or overwriting the data with a minimum of three specified patterns -- and the salvage vendor was to have done the same, the Idaho Power spokesman said. The company's probe could take several months, depending on what data was on the drives, he said. Similarly, the company will not know what regulatory penalties might apply until its investigation is completed.