Sixteen Countrywide Financial customers have filed a class action suit related to the insider theft and subsequent sale of information. The suit, filed in Ventura County Court in California, seeks millions in damages and the release of information.

The plaintiffs are suing for invasion of privacy and the exposure to identity theft, after Countrywide Financial employees stole and sold “tens of thousands, or millions” of customers’ financial records. Along with a $20 million dollar settlement for invasion of privacy and aiding and abetting, plus punitive damages, the class action also inquires as to if Countrywide merely aided and abetted the theft, or if it was an architect of the plan.

As written, the suit wants to know “whether the dissemination was intended as a plan or scheme, or was intentional; whether any of the defendants was simply aiding and abetting, rather than an architect of the plan to disseminate the personal information.”

In 2008, “coincidentally after they sold their mortgage portfolios under wrongful and fraudulent ‘securitization pools,’ and coincidentally after their mortgage portfolio went into massive default as a result thereof,” the suit says, Countywide learned that one of their own had illegally accessed and sold customer information.

After an investigation, the FBI arrested Rene L. Rebollo Jr. (36), of Pasadena, who was a former employee of Countrywide Home Loan. According to both the FBI and statements from Rebollo, he used his access to Countrywide’s computer databases to collect account information and sell it. Over two years, the sales of this information netted him about $50,000 to $70,000 USD.

At the time of the initial reports, it was discovered that an IT policy breakdown failed to detect the download of more than 2 million records. The preventative measure was to seal the USB ports on systems used by employees, opting for a physical barrier, instead of policy lockdowns and hardened DLP. One system was missed, and Rebollo used it to download the data.

However, the class action claims Countrywide was slow to admit to the data breach, and when they came clean they offered little help. The allegations in the court records say that one of the reasons for the delay was to “gain time and money”.

“Countrywide delayed several months before informing their customers. Finally, Countrywide informed only certain of their customers by letter and offered in settlement to refer the customers/borrowers to counseling, when it was Countrywide that needed to review and repair its internal procedures and it was Countrywide that needed to repair damages done to the credit of its customers.”

via Customers sue Countywide over insider data theft – Security.