1. The Choicepoint Data Security Breach February, 2005

2. What is Choicepoint? Atlanta-based company spun off from Equifax (CRA) in 1977 Atlanta-based company spun off from Equifax (CRA) in 1977 One of the largest data aggregators and resellers in the US One of the largest data aggregators and resellers in the US Compiles, stores and sells information about virtually every US adult Compiles, stores and sells information about virtually every US adult 19 billion records 19 billion records

3. Where do aggregators get information? Public records Public records Court recordsCourt records Property tax assessor filesProperty tax assessor files Professional licensesProfessional licenses Vehicle registrationsVehicle registrations Bankruptcy recordsBankruptcy records Deed transfersDeed transfers Credit reports Credit reports

4. What kind of information is in Choicepoint’s data base? Names, addresses and phone numbers Names, addresses and phone numbers Social security numbers Social security numbers Military records Military records Credit reports Credit reports Medical histories Medical histories

5. What are Choicepoint’s records used for? Credit reports Credit reports Employment background checks Employment background checks Tenant rental history Tenant rental history Insurance claims Insurance claims

6. Who does it sell to? Employers Employers Landlords Landlords Debt collectors Debt collectors Loan officers Loan officers Media organizations Media organizations Law offices Law offices Law enforcement agencies Law enforcement agencies Homeland security officials Homeland security officials

7. Examples of reports Tenant rental history Tenant rental history Landlord debtLandlord debt Criminal recordCriminal record EvictionsEvictions Registered sex offenderRegistered sex offender FBI searchesFBI searches

8. Employment background check Employment background check Arrest and conviction historyArrest and conviction history Prison, parole and release recordsPrison, parole and release records Credit historyCredit history Employment verificationEmployment verification Education verificationEducation verification License credentialsLicense credentials Business or personal reference verificationBusiness or personal reference verification

9. What was the problem? Identity thieves established phony businesses Identity thieves established phony businesses Check cashingCheck cashing Debt collectionDebt collection Used Kinko’s and Mail Boxes, Etc. to fax and receive mail Used Kinko’s and Mail Boxes, Etc. to fax and receive mail Established 50 separate accounts with Choicepoint Established 50 separate accounts with Choicepoint Used accounts to access consumers’ personal information Used accounts to access consumers’ personal information Operated more than a year before detected Operated more than a year before detected Used information to defraud at least 750 people (so far) Used information to defraud at least 750 people (so far)

10. How widespread is the problem? Affects consumers in all 50 states and three US territories Affects consumers in all 50 states and three US territories Choicepoint estimates 145,000 consumers affected Choicepoint estimates 145,000 consumers affected High of 34,000 in CaliforniaHigh of 34,000 in California Low of 2 in US Virgin IslandsLow of 2 in US Virgin Islands 111 in Vermont111 in Vermont California authorities fear up to 500,000 California authorities fear up to 500,000 Also concerns related to redirected mail belonging to 700 people found at sites Also concerns related to redirected mail belonging to 700 people found at sites

11. How was it discovered? October 2004 Choicepoint detected signs of fraudulent activities in small business accounts in Los Angeles October 2004 Choicepoint detected signs of fraudulent activities in small business accounts in Los Angeles Requests for data faxed from Kinko’sRequests for data faxed from Kinko’s Notified LA County Sheriff’s Department Notified LA County Sheriff’s Department Sting operation resulted in arrest and conviction of a Nigerian citizen Sting operation resulted in arrest and conviction of a Nigerian citizen

12. Now what? Choicepoint notified California residents under California law requiring notification to those threatened when security breached Choicepoint notified California residents under California law requiring notification to those threatened when security breached Attorneys general of 38 states demanded notification to all consumers who may have been affected Attorneys general of 38 states demanded notification to all consumers who may have been affected

13. Choicepoint has also agreed to: Rescreen its 17,000 business customers to assure legitimacy Rescreen its 17,000 business customers to assure legitimacy Pay for one-year membership in credit monitoring service for all consumers affected Pay for one-year membership in credit monitoring service for all consumers affected

14. What should consumers do? All consumers should check credit reports once per year (free) All consumers should check credit reports once per year (free) Consumers who receive notification from Choicepoint should place a fraud alert on their credit reports Consumers who receive notification from Choicepoint should place a fraud alert on their credit reports Creditors will then contact consumer before granting any credit requestsCreditors will then contact consumer before granting any credit requests