America Online has admitted that some of its members
were able to gain access to online financial portfolios of other
members.
But the internet service provider played down the incident
saying no personal identifying information such as usernames or
credit card numbers was ever compromised.
"We have heard from a handful of members who brought it to our
attention," AOL spokesman Nicholas Graham said. "We have taken some
immediate corrective steps to address the issue. Although there is
no more information, we are working very diligently to provide a
resolution to it as soon as possible."
Among those upset by what he called a security breach is lawyer
and accountant Michael Szkaradek. He said the incident occurred
when he logged onto AOL's Personal Finance page to check his
portfolio and was given another user's portfolio.
He said it was the second time in a month he entered his own
account information and got a different account. "I have various
portfolios set up, so I signed on last month and I got a completely
erroneous set of investments."
At the time, Szkaradek said he thought AOL had simply crossed
the accounts. Because he has more than one screen name, he assumed
the company had taken an old set of portfolios and displayed them
on his current one.
"I didn't think it was that big a deal because I figured
something just got crossed within my accounts," he said. "But AOL
gave me a way to fix it and then it worked fine."
Then Szkaradek got someone else's portfolio when he logged onto
AOL. "It wasn't even related to me," he said. "It shocked me
because someone else could be looking at mine."
Szkaradek decided to add information to that account to let the
other person know that AOL had let him access the account. "I told
him to give me a call and I gave him my phone number and left my
e-mail address," he said. "I didn't try to delete any of his
portfolios, but it was clear to me that I could."
Szkaradek said he is furious because AOL does not see the
problem as a security breach. He said he contacted AOL and received
the following response.
"Thank you for contacting the Personal Finance Channel. My name
is Kevin and I'll be assisting you today. Your portfolios are still
safely on our servers. There appeared to be an issue with the
portfolios not being recognised for some members. Our programmers
have corrected this at this time. I apologise for any inconvenience
this may have caused."
But Szkaradek said it was not that the system did not recognise
his portfolios; it gave him someone else's portfolios. He considers
that a breach of security.
Szkaradek said he has notified the US Federal Trade Commission
about the problem.
Linda Rosencrancewrites for
Computerworld