Pfizer employees have good reason to be angry - very angry. The company delayed weeks in notifying seventeen thousand (17,000) people that their personal information, including Social Security numbers, had been breached:

“The data, which included Social Security numbers and some additional information, was discovered on April 18 when a computer consultant found sensitive information on a peer-to-peer network.

…Pfizer did not start notifying the affected people until June 1, and the mailing was not completed until June 6, according to the company’s eight-page letter.”

link: Report: Pfizer waited weeks to notify employees of data breach

This information had been posted on the internet - and the company delayed notifying the people at risk for over nine weeks. There has to be significant legislation to protect people’s personal data. It compounds an error that the security breach was not reported to those whose data were compromised.

One wonders if the executives at Pfizer would wait a couple of months to report a missing wallet or purse. It would be inconceivable that they would allow their wallet or purse to fall into unwanted hands for over nine weeks without some sort of protective action. However, that is exactly the position that the Pfizer action (or lack of action) placed the people who had their personal information compromised. And that should be criminal.

Catherine Forsythe

Tags: pfizer, data breach, privacy, security, identity theft, delay, internet