Boston newspapers deliver subscribers' personal financial data with Sunday editions

Who needs electronic break-ins when you can just subscribe to your local newspaper to gain access to sensitive financial data?

Even in an era when embarrassing business leaks of personal financial data have become common, the failure at The Boston Globe and Worcester Telegram & Gazette is a doozy (see the Globe's story and publisher's letter to subscribers). (The Telegram & Gazette also put a notice on its Web site. Access to the site's content is restricted to paid subscribers, but you can read it if you register and give them your credit card number.)

In a mind-boggling turn of events, the paper's sister company, T&G, discarded printouts of more than 240,000 customer names that included either credit card numbers or check routing numbers without shredding them. From there the sensitive documents were recycled and somehow ended up being used used as protective wrappers on 9,000 bundles of Boston Globe and Worcester Telegram newspapers that were distributed to 2,000 retailers. T&G is owned by the parent company of both newspapers, The New York Times Company.

According to the Globe story the paper didn't realize what has transpired until it was contacted by a Cumberland Farms store.

How could this happen? As with recent backup tape fiascos, adequate policies and procedures either were not in place or were not followed. Based on what's revealed in the Globe story, it's clear that better policies were needed.

To it's credit, The Globe has opened a hotline for customers and appears to be taking steps to ensure that this type of information leak doesn't happen again. Steps cited in the story include such security 101 basics as only allowing the last four digits of a customer's credit card number to appear on printouts.

That said, the dry, factual letter from the Globe's publisher will do little to assuage outraged subscribers and looks more like a letter crafted by the company's lawyers. It falls short of accepting full responsibility, and does not offer a full and unconditional apology. It states only the paper's regret that the incident occurred and "...the inconvenience that this incident may cause" to its subscribers.