Google Employees Warned Of Data Breach At Benefits Company

Google employees hired before 2006 have been warned to watch out for possible attempts to steal their identities.

In a letter last month, Google attorney Lewis A. Segall alerted New Hampshire Attorney General Kelly A. Ayotte that computers had been stolen from Colt Express Outsourcing Services, a third-party employee benefits administrator for Google and other companies, in early June.

Segall did so by forwarding a copy of the letter from Google's director of corporate security and safety, Marty Lev, to employees affected by the Colt breach.

"The information contained on the computers related to current and former Googlers who were with Google before December 31.2005; Googlers hired after December 31, 2005 were not affected because we have had a new benefits administrator since that time," the letter explains. "We've been informed by Colt that the specific personal information for employees and dependents included names, Social Security numbers, birthdates, addresses, hire dates, and relationships; but not driver's license numbers, credit card numbers, or bank account numbers (or passwords or PINs for any financial account)."

Google's letter says there is no evidence any personal information on the stolen computers has been misused. As a precautionary measure, the company is offering to enroll affected employees in Kroll's IDTheftSmart identity and credit protection program for a year.

In a July 1 blog post, Microsoft developer Danny Thorpe, a former Google employee, said he had received such a letter.

In response to the credit monitoring offer, Thorpe said, "Well, that's something at least. I appreciate Google's gesture."

The breach occurred on May 26, 2008, when someone broke into Colt's Walnut Creek, Calif. office, according to Colt. The company says it has contacted the Walnut Creek police and the REACT high tech crime task force, based in Santa Clara, Calif. The investigation is ongoing.

According to the Identity Theft Resource Center, other companies affected by the breach include Avant Corp. (now part of Synopsys), Bebe, CBS' CNET Networks, Ebara Technologies, and Punahou School.