Iron Mountain Advises on Privacy Issues with Backup Tapes and Recommends Encryption
April 21, 2005
Boston, MA - Iron Mountain Incorporated (NYSE:IRM) is
advising its customers that current, commonly used disaster recovery
processes do not address increased requirements for protecting personal
information from inadvertent disclosure. In recent months, several
companies have disclosed incidents that may have compromised personal
information. While most of these cases involved malicious, online
identity theft, some of the events were due to the accidental loss of
computer backup tapes.
“The accidental loss of backup tapes poses a potential risk if
sensitive information stored on those tapes is unencrypted. Since Iron
Mountain stores and manages backup tapes for many major companies
around the world, we have fielded questions in recent weeks about these
issues. It is our policy not to discuss any specific customers, but
given the magnitude of our business, we’re obviously not immune from
this type of occurrence. Therefore, we want to broadly address these
questions and share our perspective on this important issue,” said
Richard Reese, Chairman and CEO, Iron Mountain. “Iron Mountain is not
aware of any incident in which the physical loss of a backup tape
resulted in the unauthorized access of personal information. It is
important to understand that unencrypted information stored on backup
tapes is difficult to read, but it is not impossible. Companies need to
reassess their backup strategies and seriously consider encrypting
sensitive data to prevent a potential breach of privacy.”
Iron Mountain performs upwards of five million pick-ups and deliveries
of backup tapes each year, with greater than 99.999% reliability.
Nevertheless, since the beginning of the year, four events of human
error at Iron Mountain resulted in the loss of a customer’s computer
backup tapes. While four losses is not a large number in comparison to
an annual rate of five million transportation events, any loss is
important to customers and to Iron Mountain.
“We invest more in training, automation and process controls than
anyone in our industry,” added Reese, “But even Iron Mountain is not
immune from human error. The only effective means to prevent
unauthorized access to data is the use of encryption.”
It is a standard practice for companies of all sizes to create multiple
copies of their computer data on backup tapes and move them off site to
a trusted third-party so that their business can recover in the event
of a disaster. However, according to a recent industry report from the
Enterprise Strategy Group, only seven percent of businesses encrypt all
of their backup tapes. For many businesses, this has been because the
encryption process increases the complexity of the backup process and
may reduce the reliability of an effective disaster recovery plan.
Nevertheless, disaster recovery planning is critical for all companies.
Experts agree that off-site storage of backup tapes will remain an
essential component of disaster recovery and other data-management
plans.
“Iron Mountain, therefore, is recommending that companies encrypt
backup tapes containing personal information, but take care to
incorporate encryption in a way that does not compromise their overall
disaster recovery plans,” advised Reese. “This announcement is the
beginning of a campaign to educate our customers on these important
issues so that together, we can start to work toward solutions.”
About Iron Mountain
Iron Mountain Incorporated (NYSE:IRM) helps
organizations around the world reduce the costs and risks associated
with information protection and storage. The Company offers
comprehensive records management and data protection solutions, along
with the expertise and experience to address complex information
challenges such as rising storage costs, litigation, regulatory
compliance and disaster recovery. Founded in 1951, Iron Mountain is a
trusted partner to more than 90,000 corporate clients throughout North
America, Europe, Latin America and the Pacific Rim. For more
information, visit the Company's Web site at www.ironmountain.com
Contact:
Melissa Mahoney
Corporate Communications
Iron Mountain
Phone: 617-535-8310
melissa.mahoney@ironmountain.com