The Nevada State Bar (the “Bar”) has confirmed that “criminals” forced their way into storage facilities maintained by the Bar related to past bar exam applicants and made off with “18 records of individuals.”  The loss appears to have been first reported here at databreaches.net.  It does not sound like much, but databreaches.net further reports that at least one case of identity theft has been confirmed.  The full press release can be found here and is reproduced below.

Although the Bar notes that the records stolen were in paper form, and not electronic form, it does make one ask whether the information would have been safer in electronic form.  On its face, and making no commentary about the content of the records stolen (because we simply do not know at this time), one would think that electronic data is more secure on servers controlled by the Bar than a storage facility subject to physical attack.  The foregoing observation makes several assumptions about the effectiveness and thoroughness of the security of the Bar’s electronic network, but such a network may be far less tempting to “criminals” that have seen too many episodes of Storage Wars.

Too often we see businesses (and their security vendors) that focus only on electronic data security.  While we are happy to see businesses finally pay attention to data security, and we find IT Departments universally eager to batten down the hatches, it is often Human Resources Departments and Records Departments that have long standing, inadequate policies that create problems.

The take away (or the tl;dr, for the kids) is do not neglect your physical records security.  Have a Clean Desk Policy in place.  Consider scanning and shredding rather than paying monthly storage fees for a decade.  Lock the filing cabinets and invest in door locks for offices containing personally identifiable information.

Full content of the press release:

Notice of Admissions Breach

The State Bar of Nevada learned that criminals forced their way into a State Bar storage facility and stole some confidential records. The State Bar is working with the Las Vegas Metropolitan Police Department in an active police investigation in this incident.

The unauthorized access took place in one storage facility where the State Bar stored historical documents in paper, not electronic, form relating to past bar exam applications. Through a complete inventory of all records the State Bar has determined that the criminals forced their way into one unit. This inventory shows 18 records of individuals were stolen. All those affected by this theft have been contacted.

The State Bar has taken and continues to take all precautions to protect the confidential records held by the State Bar.

We take this crime seriously. It was a crime against the State Bar of Nevada.

For those seeking further information, please contact Dean Gould, Admissions Director or Kimberly Farmer, Executive Director, State Bar of Nevada.