An information leak at finance firm Ameriprise exposed sensitive financial data and highlighted the importance of password protection.

Chris Vickery of the MacKeeper security research team explained how he discovered the Ameriprise leak in a blog post. After he uncovered the data, Vickery notified Ameriprise. The firm responded by locking down the sensitive financial information.

The leak demonstrated the need for executives to implore workers to back up confidential data securely. If backups are taking place on external drives or across networks, the storage device must be password protected.

Ameriprise Leak Highlights Password Security

The information, which included Social Security numbers, bank account information and financial planning data, was discovered on a backup device in the home of an Ameriprise advisor. The drive was set to coordinate backups with the employee’s main drive in the office.

However, Vickery discovered that the devices were not password protected, meaning outside actors could intercept customer data. He unearthed the database on specialist search engine Shodan and found that Ameriprise had removed both devices and begun investigating them in an IT laboratory. The databases included sensitive business documents and customer details.

Prioritizing Security

It is difficult to understand why data was being held on a backup without password protection, according to ZDNet. It is also hard to be sure whether the Ameriprise leak is an exceptional incident or a more common concern across the organization. The firm responded by stating that it prioritizes security to maintain compliance with tough governance across the financial sector and that the data leak was an isolated case.

According to Vickery, however, an employee at the firm told him that taking the storage offline was partly a precautionary measure. The firm may have pulled the devices fearing that additional backups might exist.

Best Practices for IT Decision-Makers

Ameriprise internal workers and franchise employees must now sign a policy document that covers the safeguarding of customer information. Advisors are warned that data sent across networks in an unencrypted manner could lead to security problems.

But the Ameriprise leak highlighted how errant employee activity can lead to serious consequences, even when firms put best practices in place. Internal employees account for 43 percent of data loss, according to an Intel Security report. As a result, IT decision-makers must implement high-quality education programs that train employees to use security tools effectively. Password protection should be a cornerstone, and its importance repeatedly asserted to all employees.