To: danshalon who wrote (5668 ) 7/29/2006 10:07:54 AM From: Jeffrey S. Mitchell Respond to of 12518 The latest conspiracy theorist excuse... Scheme pries loose shareholders' private information Data breach affects about 125,000 Fidelity accounts By Ross Kerber, Globe Staff | July 1, 2006 The names and holdings of shareholders in 60 public companies, including Sirius Satellite Radio Inc. and HealthSouth Corp., were improperly disclosed to an unauthorized party, according to a letter sent to shareholders by ADP Investor Communication Services. The privacy breach affected about 125,000 brokerage accounts at Fidelity Investments alone, according to a spokeswoman, Anne Crowley. Fidelity, which operates one of the country's largest discount brokerages, has about 72 million accounts. ``We were advised that other financial services firms were also notified that their customer information was disclosed," Crowley said. Spokesmen for brokerage firms Charles Schwab & Co., TD Ameritrade, and Merrill Lynch either did not immediately respond to questions yesterday or declined to comment. ADP, based in Edgewood, N.Y., is one of the nation's largest providers of investor-relations services to public companies. An ADP spokeswoman did not respond to questions yesterday. But in the letter to shareholders dated June 23, ADP said it gave the data to a party ``who appeared to ADP to be acting on behalf of public companies." That party, ADP continued, ``fraudulently requested shareholder lists for a number of public companies." ADP gave information including the names, addresses, and number of shares that they held in brokerage accounts from November through February , when it discovered the matter and alerted authorities. The breach of data follows other high-profile cases that have occurred this year and led to calls for more regulation. Data stored on laptop computers in particular have drawn much attention, including the theft of a computer from the Department of Veterans Affairs on which information on 26.5 million people was stored. That computer was recovered this week, and authorities said it appeared the data had not been accessed. Investigators often believe thieves may be more interested in the computer itself than the data it contains. But the ADP case may be unique because of the nature of the data that was compromised. ADP keeps track of contact information of shareholders, which is crucial for corporate-governance matters such as submitting proxy questions for shareholder votes. Carl Hagberg, a New Jersey corporate elections monitor, said he suspects the data could have been used to manipulate markets. Learning the names and contact information of shareholders could help an individual use tactics like selling many shares short, or bidding down a company's price. ``This was obviously for nefarious purposes. Someone went through an elaborate scheme that's clearly illegal ," Hagberg said. ADP's letter said it did not contact parties immediately because it wanted to aid investigations by federal authorities. Ross Kerber can be reached at kerber@globe.com. (Correction: Because of an editing error, a story in Saturday's Business section on the improper disclosure of names and holdings of shareholders in 60 public companies omitted saying that the privacy breach wasn't serious enough to permit unauthorized access to shareholders' accounts and that there was no evidence any of the information has been improperly used.) © Copyright 2006 Globe Newspaper Company.boston.com