A company that collects consumer data warned thousands of Californians that hackers penetrated the company's computer network and may have stolen credit reports, Social Security numbers and other sensitive information.

Share story

SAN FRANCISCO — A company that collects consumer data warned thousands of Californians that hackers penetrated the company’s computer network and may have stolen credit reports, Social Security numbers and other sensitive information.

ChoicePoint Inc., which sells such data to government agencies and a variety of companies, acknowledged Tuesday that several hackers broke into its computer database and purloined data from as many as 35,000 Californians.

Last fall, hackers apparently used stolen identities to create what appeared to be legitimate businesses seeking ChoicePoint accounts, said Chuck Jones, a spokesman for Alpharetta, Ga.-based company. They opened about 50 accounts.

The attack appears to have resulted in at least six cases of identity theft in Los Angeles County. It’s unclear whether data of people outside California were exposed. But law enforcement agents, who have arrested one person on six counts of theft, say hundreds of thousands of Americans elsewhere may be at risk.

ChoicePoint has not notified consumers in other states, nor is it working with law enforcement agents elsewhere, Jones said.

“California is the focus of the investigation and we don’t have any evidence to indicate at this point that the situation has spread beyond California,” Jones said. “If at some point in time we get information that it’s in other areas, we’ll revisit the disclosure.”

Security experts dismissed the notion that hackers would limit their attack geographically.

“I’ve never heard of a hacker doing something just to make a company comply with a state statute — that’s ridiculous,” said Nick Akerman, partner and co-chair of the computer fraud division of law firm Dorsey & Whitney. “It’d be like robbing a bank that wasn’t FDIC insured so the robber wouldn’t have to be prosecuted by the FBI.”

When ChoicePoint discovered the crime in October, it closed the suspect accounts, restricted access, strengthened site verification, informed law enforcement agencies and cooperated in their investigation.

On Oct. 27, California sheriff deputies arrested Olatunji Oluwatosin, 41, when the Nigerian national went to his office to receive a fax ostensibly from ChoicePoint. Police were waiting for the North Hollywood resident at his office in Los Angeles. He’s been in jail since then and is scheduled to appear in Los Angeles County Court on Thursday.

Robert Costa, the lieutenant in charge of Southern California’s High Tech Task Force Identity Theft Detail, said agents believe several other people were involved.

ChoicePoint sent e-mail notifications to Californians last week. State residents were the only Americans notified because the state has a unique law requiring companies that do business with residents to warn them when they’ve had holes in corporate computer networks.

Since the law went into effect in July 2003, organizations have alerted customers whenever “unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.”

Identity theft is the country’s fastest-growing crime, and more than 9.9 million Americans were victims last year. The crimes cost a total of $5 billion, not including lost productivity, according to the U.S. Postal Inspection Service.