The Identity Theft Resource Center has a running list of organizations who have data breaches. The first half of 2008 saw 342 data breaches for a rise of 69% over last year. The question is whether this is a result of more strict disclosure laws or worse security.

The breakdown of breaches for this year are 36.8% general business, 21.3% education, 17.0% governments, 14.9% health card and 10% financial institutions.

The Federal Trade Commission has issued new regulations to the Fair and Accurate Credit Transactions Act (FACTA) known as the Red Flags Rules. The new rules require financial institutions to create prevention programs to detect and respond to "patterns, practices, or specific activities that could indicate identity theft." The program must be in place by November, 1 2008.

According to the rule a financial institution is defined as banks, savings and loan associations, credit unions, and creditors. Creditors does not include every business that accepts credit cards but does include any business that extends credit. For example, finance companies, automobile dealers, mortgage brokers, utility companies, and telecommunications companies.

Some red flags that covered entities must be monitoring are:

• Alerts, notifications, or warnings from a consumer reporting agency
• Suspicious documents
• Suspicious information
  
• Unusual use of a covered account
• Notices from customers, law enforcement authorities, or other businesses

This represents the biggest changes to the FACTA law since it was enacted in 2003

We recently wrote of the acquisition of DocuVault in Denver by Iron Mountain. DocuVault of Delaware Valley has announced that they will be spun from the DocuVault Group, that was purchases by Iron Mountain, into their own company