What do:
- Ernst & Young
- Deloitte Touche Tohmatsu
- Pricewaterhouse Coopers
- KPMG
all have in common? They are the big four accounting firms in the United States and each one of them has a presence here in Orange County, CA. Like most big organizations, they work with smaller companies who provide services for them. What many business owners and managers may not realize is that the companies they work with:
- affiliates
- vendors
- satellite offices
could pose a threat to the security of their data and the data of their customers. That’s exactly what happened recently to one of these big four – Ernst & Young.
Ernst & Young purchased a company in Canada called Synergy Partners. A used computer dealer, Mark Morris, was a subcontractor of Synergy Partners when they were bought out by Ernst & Young. Morris, bought some of Synergy Partners old computer servers – but were these servers secure?
Not according to Morris. He claims the servers contained customer data belonging to Ernst & Young and now he is demanding money from Ernst & Young to secure that data. Ernst & Young now finds they are involved in a potential data breach, a lawsuit, and bad publicity – all because a company in their down line sold unwanted servers for $300. Business owners and managers – be aware that when it comes to data security, you could be responsible for the way your vendors, affiliates, and satellite offices handle your data. Are your servers secure? Are your vendors and other associates’ servers secure?
If Ernst & Young had a data security policy in place that included any organizations they worked with, they might have been able to avoid this situation. Hiring a professional data security company to dispose of the servers and provide Synergy Partners with a certificate of data destruction would have given both companies the documentation to show their customers that they care enough about their data to handle it in a professional manner. Was it worth the $300 they gained? Probably not!
Are the companies you work with following the proper procedures to be sure that any data of yours on their servers don’t wind up in the wrong hands? It’s worth setting up a compliance plan that your company, and the companies you work with, can follow to keep outdated servers secure, as well as any other data containing devices. Contact us today for a free consultation regarding compliance plans for your company and the companies you work with.