By Melissa Yeager, WINK News Story Created: Nov 12, 2009 at 3:19 PM EST
Fort Myers, FLA-- A Call for Action investigation a year in the making reveals one possible way thieves could get a hold of your personal information.
24,000 Floridians complained to the Federal Trade Commission last year about identity theft. That made Florida the 3rd most likely place for identity theft--right behind Arizona and California.
This is why the results of a WINK Call for Action investigation are so disturbing.
Last year, Call for Action spent just fifty dollars to purchase ten used hard drives on eBay.
Call for Action then took them to a computer expert who found the drives held all kinds of personal information---like bank account numbers, credit cards numbers, social security numbers, even pharmacy prescriptions.
Everything we'd need to steal someones identity.
We traced the information back to major companies.
Two companies, SEARS and Giant Foods of Maryland sent technicians to Fort Myers to examine the drives.
Neither company could tell us how their customers' personal information ended up on hard drives for sale on eBay.
But now we have new information about where they may have come from.
"56 percent of people victims of ID theft have no idea how perpetrators got their ID," said Sean O'Leary of Digital Copier Security, "And we can assume a portion or large part is a result of data breeches from photocopiers."
That's right - photocopiers.
O'Leary says he believes most companies don't realize their copy machines have hard drives.
"We just take it for granted this little photocopier sitting in the corner of an office is safe and innocuous," said O'Leary, "But in reality, with that hard drive it's storing personal information."
Today's copy machines do a whole lot more than copy. They print. They scan. They email. They fax.
The machine has to have a way to remember all that information.
Between 1998 and 2002, companies began equipping copy machines with hard drives.
O'Leary says most companies lease their copy machines. He suspects most have no idea when they trade in their old copier, they're also turning over a whole lot of personal information.
"If you think about it, when you go to a new employer, you start a new job, first thing they do in your orientation is they take a copy of your drivers license and your social security card," said O'Leary, "And that information is maintained on that photocopier. So it basically becomes an identity theft's dream."
We contacted both Giant of Maryland and SEARS. Both companies told us they did a thorough investigation.
They wouldn't tell us how the hard drives left their hands, only that they did not believe the hard drives came from copiers.
But some of the documents we found may indicate O'Leary is right.
One from a Giant of Maryland store is a list of topics to cover during a staff meeting. That could mean it could have been copied to hand out to the staff.
"I think companies who use these machines should treat them exactly the way they would a personal computer," said O'Leary, "Because functionally they both contain hard drives so they need to take the same care in disposing of photocopiers as they do with a personal computer."
O'Leary estimates it would cost about 500 dollars a hard drive to dispose of the information. He would like to see legislation dealing with this issue and see companies that lease copy machines inform their customers about the hard drives.